GCVE - cpe:2.3:a:convos:convos:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:convos:convos:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Convos (`302d2761-697a-56cd-9411-c1eea1f2c2a0`)
Product	Convos (`7991084b-bc27-5808-9092-25aa953e0953`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/convos-chat/convos`	purl2cpe	2026-06-01 10:11:43.870340

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-21650`	vulnerable	2026-06-08 05:40:01.927696	Stored XSS via html file upload in convos HIGH (7.6) Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after uploading a file the XSS attack is triggered upon a user viewing the file. Through this vulnerability, an attacker is capable to execute malicious scripts. Users are advised to update as soon as possible. Published: 2022-01-04T20:40:14.000Z Updated: 2025-04-22T18:34:37.741Z Open on db.gcve.eu Reference links https://blog.pocas.kr/2021/12/30/2021-12-30-s-xss-convos-chat/#First-vulnerability https://github.com/convos-chat/convos/commit/5c0a1ec9a2c147bc3b63fd5a48da5f32e18fe5df https://www.huntr.dev/bounties/ae424798-de01-4972-b73b-2db674f82368/ https://github.com/convos-chat/convos/security/advisories/GHSA-mm2v-4v7g-m695	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-21649`	vulnerable	2026-06-08 05:40:01.927069	Stored XSS via attribute in convos HIGH (7.6) Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an <a> tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "<" or ">" but escaping for double quotes does not exist. Through this vulnerability, an attacker is capable to execute malicious scripts. Users are advised to update as soon as possible. Published: 2022-01-04T20:40:20.000Z Updated: 2025-04-22T18:34:30.665Z Open on db.gcve.eu Reference links https://blog.pocas.kr/2021/12/30/2021-12-30-s-xss-convos-chat/#Second-vulnerability https://github.com/convos-chat/convos/commit/86b2193de375005ba71d9dd53843562c6ac1847c https://www.huntr.dev/bounties/4532a0ac-4e7c-4fcf-9fe3-630e132325c0/ https://github.com/convos-chat/convos/security/advisories/GHSA-xmpj-xwm3-vww7	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-42584`	vulnerable	2026-06-08 05:35:22.370542	Details available A Stored Cross Site Scripting (XSS) issue exists in Convos-Chat before 6.32. Published: 2021-12-17T13:02:26.000Z Updated: 2024-08-04T03:38:49.497Z Open on db.gcve.eu Reference links https://github.com/convos-chat/convos/commit/14a3b1e98cd1a3211c0ef3d4f5ffdbc60baaca54 https://github.com/convos-chat/convos/issues/623 https://dev696.github.io/Writeup/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-14423`	vulnerable	2026-06-08 05:19:23.342533	Details available Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predictable CONVOS_LOCAL_SECRET value, affecting password resets and invitations. Published: 2020-06-18T13:27:19.000Z Updated: 2024-08-04T12:46:34.464Z Open on db.gcve.eu Reference links https://convos.chat/blog/2020/6/18/local-secret-got-more-secure https://github.com/Nordaaker/convos/commit/54d1763ac65c05aad27ad454b4e5a62ba8352d39 https://github.com/Nordaaker/convos/compare/4.19...4.20	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.