repository icon
chatwoot / chatwoot Project repository

Open-source live-chat, email support, omni-channel desk. An alternative to Intercom, Zendesk, Salesforce Service Cloud etc. 🔥💬

Submit a report

FIRST INTERACTION

WITHIN3 DAYS

REVIEW

WITHIN27 DAYS

FIX

WITHIN169 DAYS

Path traversal vulnerability exists in the website of chatwoot
l0kihardt
not applicable
Regular Expression Denial of Service (ReDoS)
nielymmah
spam
stored xss via dashboard app
ranjit-git
Medium
•CVE-2024-0640
csrf bug to add slack integration
ranjit-git
not applicable
Stored AWS Secrets in Git Histor
testaccount12340
not applicable
No rate-limit and fair character limit on client support message leads to DOS
akshayravic09yc47
informative
High
Race Condition flaw in "Canned Responses" function
aqngoc
informative
Medium
No rate limit on Forgot Passwords Lead To Dos and inbox flooding for any user
novemberdad
informative
Medium
enable 2fa lead to improper acces controls/account takeover
novemberdad
self closed
Request Manipulation Resulting to Unauthorized Email Registration
b1tch3s
informative
Medium
Account Takeover
thewhiteevil
not applicable
Unverified Email Sign-Up Allows Pre-Account Takeover
sl4x0
informative
High
XSS via postMessage to deface any website and account takeover
renwax23
Medium
•$75•CVE-2023-2109
DoS via Customer Contact
vultza
informative
Medium
DoS via Unauthenticated Inbox Message
vultza
informative
High
Sensitive Data Exposure - Application API Key
retr0security
spam
User that interacts with agent can insert HTML elements in the contact's field t...
drjgouveia
informative
Medium
Path traversal leading to RCE on development server in chatwoot/chatwoot
ooooooo-q
not applicable
Lack of url validation lead to DOS
rezaduty
informative
Low
Lack of email validation lead to verification bypass
rezaduty
not applicable
Agent can get inbox credentials through api
mani-zur
Medium
•$75
Identity Validation Bypass in Inbox API Channel
jonas-hollm
not applicable
improper input validation lead to stored xss
maakthon
not applicable
Formula injection via Full Name
kevin-mizu
Medium
•$75
Improper Input Validation
maakthon
not applicable
Improper authorization lead an agent can view the list of teams, even if has not...
baobaovt
not applicable
Hyper Link Injection in Full name and Account name
sampritdas8
informative
Critical
Sensitive Data Exposure Due To Insecure Storage Of Profile Image in
sampritdas8
not applicable
UUIDs for messages rely on
ndren
not applicable
UI Redressing (Clickjacking)
0xcybery
self closed
Improper Authorization lead an low-privilege user enable to view agents list
baobaovt
informative
High
Unrestricted file upload vulnerability lead an user upload Dangerous/Unaccepted...
baobaovt
not applicable
User enumeration via login response timing
vultza
informative
Medium
DoS via Client Email Update
vultza
High
•$145
stored xss to to steal session-token and hijack account
ranjit-git
not applicable
Improper Authorization lead a user add an arbitrary agent into Team
baobaovt
High
•$145•CVE-2022-2901
UI Redressing
lengochoa7112000
informative
Medium
Chatwoot's Misconfigured Rack_Attack.rb Does Not Appropriately Protect Against B...
dievus
Critical
•$957•CVE-2022-3741
Improper Handling of _chatwoot_session Cookie Allows for Cookie Reuse and super_...
dievus
informative
High
Remote access to another's conversation based on their email address
helmo-nico
High
•$45
Insecure Storage of Sensitive Information
ranjit-git
High
•$250•CVE-2022-1021
Cross-site Scripting (XSS) - Stored
scara31
High
•$85•CVE-2022-1022
Improper Input Validation
popeeyy
Medium
Cross-site Scripting (XSS) - Stored
n1k1x86
Medium
•$85•CVE-2022-0527
Cross-site Scripting (XSS) - DOM
scara31
High
•$82.5•CVE-2022-0542
Cross-site Scripting (XSS) - Stored
scara31
High
•$82.5•CVE-2022-0526
Denial of Service
ghost
High
Omission of Security-relevant Information
noezdev
High
Origin Validation Error
hi-unc1e
Low
•$150
Improper Privilege Management
thelabda
Medium
•$80•CVE-2021-3813
Cross-site Scripting (XSS) - Stored
b3ef
High
•$80•CVE-2021-3741
Server-Side Request Forgery (SSRF)
b3ef
High
•$80•CVE-2021-3742
Session Fixation
b3ef
Medium
•$80•CVE-2021-3740
Inefficient Regular Expression Complexity
am0o0
High
•$80•CVE-2021-3649
Execution with Unnecessary Privileges
ranjit-git
High
•$80
Improper Restriction of Excessive Authentication Attempts
ghost
High
•$80
Classic Buffer Overflow
ziddiqui42
High
•$80
Improper Privilege Management
ranjit-git
High
•$80
Improper Privilege Management
ranjit-git
High
•$80
Improper Privilege Management
ranjit-git
High
•$80
Cross-site Scripting (XSS) - Generic
ranjit-git
High
•$40