CVE-2025-21628

CVE-2025-21628 affects Chatwoot (conversation and contact filters endpoints). Before version 3.16.0, user-provided query_operator input was not sanitized, enabling an authenticated actor to inject arbitrary SQL into the filter query (tautological WHERE clause). Impact is mitigated by upgrading to...

CVE-2021-22905

CVE-2021-22905 concerns the Nextcloud Android App (com.nextcloud.client) before v3.16.0, where searches for sharees were performed by the lookup server by default instead of restricting to the local Nextcloud server unless the user explicitly selects a global search. This behavior could disclose ...