CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 20/03/2025 |
| CVE-2025-21628 | 高8.8 | Chatwoot is a customer engagement suite. Prior to 3.16.0, conversation and contact filters endpoints did not sanitize the input of query_operator passed from the frontend or the API. This provided any actor who is authenticated, an attack vector to run arbitrary SQL within the filter query by adding a tautological WHER | 09/01/2025 |
| CVE-2021-3742 | 高8.8 | A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0. The vulnerability allows an attacker to upload an SVG file containing a malicious SSRF payload. When the SVG file is used as an avatar and opened in a new tab, it can trigger the SSRF, potentia | 15/11/2024 |
| CVE-2021-3741 | 中5.4 | A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerability occurs when a user uploads an SVG file containing a malicious XSS payload in the profile settings. When the avatar is opened in a new page, the custom JavaScript code is executed | 15/11/2024 |
| CVE-2021-3740 | 中6.8 | A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions on other devices when a user changes their password, allowing old sessions to persist. This can lead to unauthorized access if an attacker has obtained a session token. | 15/11/2024 |
| CVE-2023-2109 | 中6.1 | Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0. | 17/04/2023 |
| CVE-2022-3741 | 緊急9.8 | Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output Status Code to separat | 28/10/2022 |
| CVE-2022-2901 | 高7.1 | Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8. | 06/09/2022 |
| CVE-2022-0542 | 中6.1 | Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0. | 19/08/2022 |
| CVE-2022-1021 | 中5.4 | Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0. | 19/08/2022 |
| CVE-2022-1022 | 中5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0. | 21/04/2022 |
| CVE-2021-3813 | 中6.5 | Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2. | 09/02/2022 |
| CVE-2022-0527 | 中6.1 | Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0. | 09/02/2022 |
| CVE-2022-0526 | 中6.1 | Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0. | 09/02/2022 |
| CVE-2021-3649 | 高7.5 | chatwoot is vulnerable to Inefficient Regular Expression Complexity | 16/07/2021 |