CVE-2021-3741

A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerability occurs when a user uploads an SVG file containing a malicious XSS payload in the profile settings. When the avatar is opened in a new page, the custom JavaScript code is executed, leading to potential security risks.

• CWE-79

• https://github.com/chatwoot/chatwoot/commit/6fdd4a29969be8423f31890b807d27d13627c50cProduct
• https://huntr.com/bounties/1625474692857-chatwoot/chatwootBroken Link

Published

Nov 15, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37401An attacker may obtain the user credentials from file server…9.8
• CVE-2021-37402OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-re…6.1
• CVE-2021-37403OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-re…6.1
• CVE-2021-37404There is a potential heap buffer overflow in Apache Hadoop l…9.8
• CVE-2021-37405Rejected reason: This is unused.
• CVE-2021-37409Improper access control for some Intel(R) PROSet/Wireless Wi…7.8
• CVE-2021-37412The TechRadar app 1.1 for Confluence Server allows XSS via t…6.1
• CVE-2021-37413GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerab…9.8
• CVE-2021-37414Zoho ManageEngine DesktopCentral before 10.0.709 allows anyo…7.5
• CVE-2021-37415Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerabl…9.8
• CVE-2021-37416Zoho ManageEngine ADSelfService Plus version 6103 and prior …6.1
• CVE-2021-37417Zoho ManageEngine ADSelfService Plus version 6103 and prior …9.8