Chatwoot/Chatwoot
Approved changes feed: RSS · Atom
cpe:2.3:a:chatwoot:chatwoot/chatwoot:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Chatwoot (cdb47e75-0d0f-5ab5-a9c9-b546a17b1a40) |
|---|---|
| Product | Chatwoot/Chatwoot (71eaf469-083c-5e44-b155-9309fe9ede57) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-0640 |
vulnerable | 2026-06-08 06:22:01.596314 |
Stored XSS in chatwoot/chatwoot
MEDIUM (5.6)
A stored cross-site scripting (XSS) vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1. This vulnerability allows an admin user to inject malicious JavaScript code via the dashboard app settings, which can then be executed by another admin user when they access the affected dashboard app. The issue is fixed in version 3.5.2.
Published: 2025-03-20T10:10:52.310Z
Updated: 2025-03-20T14:25:04.236Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2109 |
vulnerable | 2026-06-08 06:02:41.433278 |
Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot
MEDIUM (5.3)
Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0.
Published: 2023-04-17T00:00:00.000Z
Updated: 2025-02-05T21:23:18.784Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-3741 |
vulnerable | 2026-06-08 05:48:21.819884 |
Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot
CRITICAL (9.4)
Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output Status Code to separate accounts that are generated and waiting for email verification. \n\nFor the sign in directories, it is possible to brute force login attempts to either login portal, which could lead to account compromise.
Published: 2022-10-28T00:00:00.000Z
Updated: 2025-05-09T19:19:52.573Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2901 |
vulnerable | 2026-06-08 05:43:36.689788 |
Improper Authorization in chatwoot/chatwoot
HIGH (7.6)
Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8.
Published: 2022-09-06T09:15:12.000Z
Updated: 2024-08-03T00:53:00.430Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-1022 |
vulnerable | 2026-06-08 05:39:11.694045 |
Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot
HIGH (8.1)
Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0.
Published: 2022-04-21T14:25:12.000Z
Updated: 2024-08-02T23:47:43.300Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-1021 |
vulnerable | 2026-06-08 05:39:11.693390 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0542 |
vulnerable | 2026-06-08 05:39:10.258612 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0527 |
vulnerable | 2026-06-08 05:39:10.213415 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0526 |
vulnerable | 2026-06-08 05:39:10.211902 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-3813 |
vulnerable | 2026-06-08 05:33:54.365269 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-3742 |
vulnerable | 2026-06-08 05:33:53.884372 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-3741 |
vulnerable | 2026-06-08 05:33:53.883862 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-3740 |
vulnerable | 2026-06-08 05:33:53.883540 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-3649 |
vulnerable | 2026-06-08 05:33:53.284124 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.