CVE-2024-27516

CVE-2024-27516 affects livehelperchat prior to version 4.34. The SSTI exists in the search parameter of lhc_web/modules/lhfaq/faqweight.php, enabling remote code execution and access to sensitive data. Impact is high (as per sources) including arbitrary code execution and data disclosure. Recomme...

CVE-2022-1191

CVE-2022-1191 affects LiveHelperChat (GitHub/LHS) with a Server-Side Request Forgery (SSRF) vulnerability via index.php/cobrowse/proxycss/ exposed before version 3.96. The issue enables the app to make arbitrary requests; remediation is to upgrade to 3.96 or later. Related OSV/GHSA entries corrob...

CVE-2022-0612

CVE-2022-0612 describes a stored Cross-site Scripting (XSS) in the Packagist package remdex/livehelperchat, prior to version 3.93. The issue arises from insufficient validation of client-side data by the web application, enabling injection of script via stored payloads. Affected component is the ...

CVE-2022-1234

CVE-2022-1234 is an XSS vulnerability affecting the LiveHelperChat project (livehelperchat/livehelperchat) prior to version 3.97. The issue is exposed in the GitHub repository and can be triggered by improper handling of input, potentially allowing an attacker to deface a website, hijack user acc...

CVE-2022-1213

CVE-2022-1213 describes an SSRF bypass in LiveHelperChat. Affected: the GitHub repo livehelperchat/livehelperchat prior to version 3.67 (as stated in multiple connected entries). The issue is related to bypassing CVE-2022-1191. Other entries corroborate SSRF in LiveHelperChat, but the documents d...

CVE-2022-1530

CVE-2022-1530 corresponds to a Cross-site Scripting (XSS) vulnerability in livehelperchat/livehelperchat (GitHub repository) prior to version 3.99. The issue allows an attacker to execute malicious JavaScript within the application. Available sources indicate the vulnerability affects versions be...

CVE-2022-1235

The CVE-2022-1235 issue affects livehelperchat/livehelperchat prior to version 3.96, where a weak secrethash can be brute-forced. The secrethash consists of 10 hex characters, yielding 16^10 possibilities, enabling offline guessing of the secret (SHA1) and compromising security measures tied to t...

CVE-2022-1176

LiveHelperChat CGI issue CVE-2022-1176 involves a loose comparison that enables Insecure Direct Object Reference (IDOR) across multiple endpoints in LiveHelperChat prior to version 3.96. Affected software: LiveHelperChat (web-based live support system). Root cause: loose comparison leading to IDO...

CVE-2020-26134

Live Helper Chat before 3.44v is affected by a stored XSS in chat messages via BBCode, exploitable by an operator. A security update 3.44v addresses this vulnerability. No details on exploitation beyond the described stored XSS are provided in the supplied documents.

CVE-2022-0374

CVE-2022-0374 corresponds to a Stored XSS in livehelperchat (Packagist remdex/livehelperchat) prior to version 3.93. The vulnerability arises from unsanitized user-supplied input that can be stored and later rendered, enabling script execution. Multiple connected records (OSV, NVD, CNVD, huntr, e...

CVE-2022-0375

CVE-2022-0375 is a Stored XSS vulnerability in LiveHelperChat (Packagist remdex/livehelperchat) prior to 3.93, affecting the Name field in Admin themes under System configuration. The root cause is stored XSS that can deface sites or compromise user sessions when an attacker injects malicious pay...

CVE-2022-0935

CVE-2022-0935 affects livehelperchat/livehelperchat prior to 3.97 and is caused by Host Header injection in the password reset flow. Multiple sources (NVD, Red Hat, OSV, CNVD, PT-Security, CNVD) describe an attacker abusing header handling to forge or manipulate password reset tokens, potentially...

CVE-2022-0226

CVE-2022-0226 affects livehelperchat with CSRF vulnerability. Multiple sources (OSV, GHSA, CVE listing) confirm CSRF in livehelperchat, noting that in at least one advisory the server-side CSRF token validation is missing in audit configuration, allowing actions if the token field is empty. Affec...

CVE-2022-0395

CVE-2022-0395 is a stored XSS vulnerability in LiveHelperChat (Packagist remdex/livehelperchat) before version 3.93. The issue affects the web application's handling of user-supplied input, enabling attacker-controlled scripts to run in a victim’s browser. Multiple sources (NVD entry, OSV/GHSA ad...

CVE-2022-0083

livehelperchat is affected by CVE-2022-0083, a vulnerability described as Generation of Error Message Containing Sensitive Information. Multiple connected sources (NVD, OSV, GHSA, CNVD, CNNVD) confirm an information-disclosure issue arising from verbose or leaking error messages, with sources not...

CVE-2022-0394

The CVE-2022-0394 entry relates to a stored Cross-site Scripting (XSS) vulnerability in LiveHelperChat (Packagist remdex/livehelperchat). Affected versions are prior to 3.93. Root cause details are not explicitly stated beyond the stored XSS characterization, but multiple connected records confir...

CVE-2021-4169

CVE-2021-4169 affects livehelperchat. The vulnerability is an Improper Neutralization of Input During Web Page Generation (XSS) in livehelperchat. Open sources describe reflected/DOM-based XSS vectors enabling injection via user input, with impact limited to client-side script execution and poten...

CVE-2022-0266

CVE-2022-0266 affects livehelperchat (Packagist remdex/livehelperchat) prior to version 3.92. The vulnerability is described as an authorization bypass via a user-controlled key. Multiple connected sources (OSV, CNVD/CNNVD, NVD, CVE lists) consistently reference the same issue and suggest upgradi...

CVE-2022-0231

CSRF vulnerability in livehelperchat (CVE-2022-0231) is documented across multiple sources. The issue arises in the admin file configuration endpoint (/site_admin/file/configuration), where requests can be forged due to missing CSRF token validation. A successful exploit can allow an attacker to ...

CVE-2021-4132

CVE-2021-4132 affects the LiveHelperChat project. The exposure is a Cross-site Scripting (XSS) flaw described as Improper Neutralization of Input During Web Page Generation, enabling stored XSS in the application. The most concrete details come from multiple connected sources: stored XSS in user ...

CVE-2022-0502

CVE-2022-0502 affects the LiveHelperChat package remdex/livehelperchat. Multiple connected sources confirm a stored Cross-site Scripting (XSS) vulnerability in this package prior to version 3.93. Root cause identified as XSS in the livehelperchat package stored in Packagist. Impact is user-visibl...

CVE-2021-4123

Technical details about CVE-2021-4123 are not publicly available in the provided documents. Monitor for updates from vendors and researchers for affected products, versions, impact, and fixes.

CVE-2021-4050

CVE-2021-4050 affects the livehelperchat project and is a Stored Cross-Site Scripting (XSS) vulnerability rooted in improper neutralization of input during web page generation. The issue is triggered via the user’s Account data exposure, specifically in the Photo section where an uploaded SVG (av...

CVE-2021-4131

CVE-2021-4131 affects livehelperchat and describes a Cross-Site Request Forgery (CSRF) vulnerability. The incident is corroborated by multiple sources in the connected documents, which list CSRF as the vulnerability class for livehelperchat and provide CVSS metrics: CVSS v3.1 base score 8.8 (vect...

CVE-2021-4177

The CVE-2021-4177 entry relates to livehelperchat and is an information disclosure vulnerability caused by generating error messages that contain sensitive details. Public documents consistently describe the issue as an information leak stemming from error message handling, with no precise affect...

CVE-2021-4049

CVE-2021-4049 affects livehelperchat with a Cross-Site Request Forgery (CSRF) vulnerability. Public sources (GHSA/Huntr and OSV entries) describe an attacker who can log out a user by causing the user, while logged in, to visit a malicious site; no product/version fix details are provided in the ...

CVE-2021-4176

CVE-2021-4176 affects livehelperchat and is described across multiple sources as a Cross-site Scripting (XSS) vulnerability caused by Improper Neutralization of Input During Web Page Generation. The connected documents confirm the issue but do not provide concrete affected versions, vendor-specif...

CVE-2017-1000059

Live Helper Chat version 2.06v and older is affected by a Cross‑Site Scripting flaw in HTTP header handling, enabling execution of attacker-supplied JavaScript in another user’s session. Affected: Live Helper Chat; component: HTTP header processing; root cause: improper header data handling. Impa...

CVE-2021-4179

CVE-2021-4179 affects livehelperchat and is described as a Cross-site Scripting (stored) vulnerability due to Improper Neutralization of Input During Web Page Generation. Several connected sources state the issue originates from how user input is rendered in web pages, enabling injected scripts t...

CVE-2021-4175

Summary: CVE-2021-4175 affects livehelperchat with a stored Cross-site Scripting (XSS) vulnerability arising from improper neutralization of input during web page generation. Multiple sources (OSV, CNVD, CNNVD, CVE records) corroborate XSS in livehelperchat. Affected component is the web page gen...

CVE-2020-26135

CVE-2020-26135 affects Live Helper Chat prior to version 3.44 and allows a reflected XSS via the setsettingajax PATH_INFO. The available connected docs confirm the vulnerability description but do not provide details on affected exact versions beyond “before 3.44v,” nor do they specify concrete e...

CVE-2025-51397

CVE-2025-51397 is a stored XSS in Live Helper Chat (Facebook Chat module) affecting version 4.60 (and around 4.61 according to some sources). The vulnerability occurs when an attacker injects a crafted payload into the Recipient List’s Surname field, which is stored and can execute script when an...

CVE-2025-51401

CVE-2025-51401 is a stored XSS in the Live Helper Chat chat transfer function, triggered by crafting the operator name parameter. Affected version: Live Helper Chat v4.60 (and related references indicate ≤4.61 in some advisories). The underlying issue is unsanitized input stored and later rendere...

CVE-2025-51398

CVE-2025-51398 is a stored XSS in Live Helper Chat on the Facebook integration page. Affects Live Helper Chat versions ≤ 4.60 (some sources reference 4.60/4.61); the vulnerability arises from insufficient validation/output encoding of the Name parameter, allowing an attacker to inject arbitrary s...

CVE-2025-51400

CVE-2025-51400 is a stored XSS in Live Helper Chat’s Personal Canned Messages. Affected versions include 4.60 (and 4.61 per sources). Root cause is insufficient input validation/storage of crafted payloads in the Personal Canned Messages, enabling arbitrary JavaScript execution when an admin/oper...

CVE-2026-27954

Live Helper Chat is affected up to version 4.52. The flaw arises in three chat action endpoints (holdaction.php, blockuser.php, transferchat.php) which load chat objects by ID without calling erLhcoreClassChat::hasAccessToRead(), enabling operators with holduse, allowblockusers, or allowtransfer ...

CVE-2025-51396

CVE-2025-51396 concerns a stored XSS in Live Helper Chat (LHChat) versions up to 4.60/4.61. The vulnerability arises from insufficient validation of the Telegram Bot Username parameter, allowing an attacker to inject and store a payload that can execute scripts when admins view or edit the Telegr...

CVE-2025-51403

Vulnerability : CVE-2025-51403 affects Live Helper Chat (v4.60/v4.61 era) in the department assignment editing module. The issue is a stored XSS via the Alias Nick field, caused by insufficient validation/escaping of user input. Impact : stored XSS could allow a logged-in user with low privileges...