Skip to content
OpenAdvisories

Vendor

convos-chat

2 known vulnerabilities.

Products

convos 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.6
    CVE-2022-21649

    Stored XSS via attribute in convos

    Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an <a> tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "<" or ">" but escaping for …

    convos-chat convos
  • High 7.6
    CVE-2022-21650

    Stored XSS via html file upload in convos

    Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This…

    convos-chat convos