A security flaw has been discovered in chatwoot up to 4.7.0. This issue affects some unknown processing of the file app/javascript/shared/components/IframeLoader.vue of the component Admin Interface. The manipulation of the argument Link results in cross site scripting. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
References
| Link | Resource |
|---|---|
| https://hckwr.com/blog/multiple-vulnerabilities-in-chatwoot/ | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.329917 | Permissions Required VDB Entry |
| https://vuldb.com/?id.329917 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.673801 | Third Party Advisory VDB Entry |
Configurations
History
28 Oct 2025, 02:12
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://hckwr.com/blog/multiple-vulnerabilities-in-chatwoot/ - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.329917 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.329917 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.673801 - Third Party Advisory, VDB Entry | |
| CPE | cpe:2.3:a:chatwoot:chatwoot:*:*:*:*:*:*:*:* | |
| First Time |
Chatwoot chatwoot
Chatwoot |
27 Oct 2025, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-27 08:15
Updated : 2025-10-28 02:12
NVD link : CVE-2025-12246
Mitre link : CVE-2025-12246
CVE.ORG link : CVE-2025-12246
JSON object : View
Products Affected
chatwoot
- chatwoot