Skip to content
OpenAdvisories

Vendor

wppconnect

2 known vulnerabilities.

Products

wppconnect-server 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-123197

    WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /files

    WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount. Attackers can enumerate Unix timestamps in GET /files/file<timestamp>.webp…

    wppconnect wppconnect-server
  • Medium 5.9
    CVE-2026-121557

    WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot

    WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected ses…

    wppconnect wppconnect-server