Livehelperchat

livehelperchat

42 CVEs • 2 products

Products (2)

Click to collapse

Toggle

CVEs (42)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-27954 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Feb 26, 2026 4.9 MEDIUM· v4 6.5 MEDIUM· v3 N/A· v2 Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdaction.php, blockuser.php, and transferchat.php) load chat object...Show more Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdaction.php, blockuser.php, and transferchat.php) load chat objects by ID without calling `erLhcoreClassChat::hasAccessToRead()`, allowing operators to act on chats in departments they are not assigned to. Operators with the relevant role permissions (holduse, allowblockusers, allowtransfer) can hold, block users from, or transfer chats in departments they are not assigned to. This is a horizontal privilege escalation within one organization. As of time of publication, no known patched versions are available.Show less
CVE-2025-51403 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Jul 21, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into th...Show more A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Alias Nick parameter.Show less
CVE-2025-51401 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Jul 21, 2025 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the operator name p...Show more A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the operator name parameter.Show less
CVE-2025-51400 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Jul 21, 2025 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
CVE-2025-51398 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Jul 21, 2025 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parame...Show more A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.Show less
CVE-2025-51397 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Jul 21, 2025 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Surname parameter...Show more A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Surname parameter under the Recipient' Lists.Show less
CVE-2025-51396 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Jul 21, 2025 N/A· v4 5.4 MEDIUM· v3 N/A· v2 A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Telegram Bot Username parameter.
CVE-2024-27516 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Feb 29, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faq...Show more Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faqweight.php.Show less
CVE-2022-1530 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Apr 29, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute malicious JavaScript on the application.
CVE-2022-0935 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Apr 7, 2022 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.
CVE-2022-1234 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Apr 6, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web page...Show more XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device.Show less
CVE-2022-1235 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Apr 5, 2022 N/A· v4 8.2 HIGH· v3 6.4 MEDIUM· v2 Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96.
CVE-2022-1213 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Apr 5, 2022 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191
CVE-2022-1176 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Mar 31, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96.
CVE-2022-1191 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Mar 31, 2022 N/A· v4 8.1 HIGH· v3 5.5 MEDIUM· v2 SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96.
CVE-2022-0612 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Feb 16, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
CVE-2022-0502 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Feb 6, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
CVE-2022-0395 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Jan 28, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
CVE-2022-0394 1Livehelperchat 1Live Helper Chat Jun 17, 2026 Jan 28, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
CVE-2022-0387 1Livehelperchat 1Livehelperchat Jun 17, 2026 Jan 27, 2022 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.

12 3 Next