Exposure of Chatwoot

Live chat

23

exposure score

5,062

sites use

0

exploited

1

critical

CVEs

10 results

CVE-2026-63765HIGHChatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob CreationEPSS 0.7%CVE-2025-21628CRITICALChatwoot has a Blind SQL-injection in Conversation and Contacts filtersEPSS 0.7%CVE-2026-72719MEDIUMChatwoot: Cross-Account Resource Transfer via `account_id` ParameterEPSS 0.4%CVE-2025-12246MEDIUMchatwoot Admin IframeLoader.vue cross site scriptingEPSS 0.4%CVE-2026-4990MEDIUMchatwoot Signup Endpoint login improper authorizationEPSS 0.4%CVE-2026-92527MEDIUMchatwoot Shopify OAuth callbacks_controller.rb server-side request forgeryEPSS 0.4%CVE-2026-44707MEDIUMChatwoot: Pre-Account Takeover via OAuth on Unconfirmed AccountsEPSS 0.3%CVE-2025-12245MEDIUMchatwoot Widget IFrameHelper.js initPostMessageCommunication origin validationEPSS 0.3%CVE-2026-5205MEDIUMchatwoot Webhook API trigger.rb Trigger server-side request forgeryEPSS 0.3%CVE-2026-44706HIGHChatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute ValuesEPSS 0.2%