CVE-2024-27516

A Server-Side Template Injection (SSTI) vulnerability exists in livehelperchat versions prior to 4.34 . Remote attackers can exploit the search parameter in the lhc_web/modules/lhfaq/faqweight.php file to execute arbitrary code and obtain sensitive information. To remediate this issue, users shou...

CVE-2022-1191

CVE-2022-1191 affects LiveHelperChat (GitHub/LHS) with a Server-Side Request Forgery (SSRF) vulnerability via index.php/cobrowse/proxycss/ exposed before version 3.96. The issue enables the app to make arbitrary requests; remediation is to upgrade to 3.96 or later. Related OSV/GHSA entries corrob...

CVE-2022-0612

CVE-2022-0612 describes a stored Cross-site Scripting (XSS) in the Packagist package remdex/livehelperchat, prior to version 3.93. The issue arises from insufficient validation of client-side data by the web application, enabling injection of script via stored payloads. Affected component is the ...

CVE-2022-1234

CVE-2022-1234 is an XSS vulnerability affecting the LiveHelperChat project (livehelperchat/livehelperchat) prior to version 3.97. The issue is exposed in the GitHub repository and can be triggered by improper handling of input, potentially allowing an attacker to deface a website, hijack user acc...

CVE-2022-1213

CVE-2022-1213 describes an SSRF bypass in LiveHelperChat. Affected: the GitHub repo livehelperchat/livehelperchat prior to version 3.67 (as stated in multiple connected entries). The issue is related to bypassing CVE-2022-1191. Other entries corroborate SSRF in LiveHelperChat, but the documents d...

CVE-2022-1530

CVE-2022-1530 corresponds to a Cross-site Scripting (XSS) vulnerability in livehelperchat/livehelperchat (GitHub repository) prior to version 3.99. The issue allows an attacker to execute malicious JavaScript within the application. Available sources indicate the vulnerability affects versions be...

CVE-2022-1235

The CVE-2022-1235 issue affects livehelperchat/livehelperchat prior to version 3.96, where a weak secrethash can be brute-forced. The secrethash consists of 10 hex characters, yielding 16^10 possibilities, enabling offline guessing of the secret (SHA1) and compromising security measures tied to t...

CVE-2022-1176

LiveHelperChat CGI issue CVE-2022-1176 involves a loose comparison that enables Insecure Direct Object Reference (IDOR) across multiple endpoints in LiveHelperChat prior to version 3.96. Affected software: LiveHelperChat (web-based live support system). Root cause: loose comparison leading to IDO...

CVE-2020-26134

Live Helper Chat before 3.44v is affected by a stored XSS in chat messages via BBCode, exploitable by an operator. A security update 3.44v addresses this vulnerability. No details on exploitation beyond the described stored XSS are provided in the supplied documents.

CVE-2022-0375

CVE-2022-0375 is a Stored XSS vulnerability in LiveHelperChat (Packagist remdex/livehelperchat) prior to 3.93, affecting the Name field in Admin themes under System configuration. The root cause is stored XSS that can deface sites or compromise user sessions when an attacker injects malicious pay...

CVE-2022-0374

CVE-2022-0374 corresponds to a Stored XSS in livehelperchat (Packagist remdex/livehelperchat) prior to version 3.93. The vulnerability arises from unsanitized user-supplied input that can be stored and later rendered, enabling script execution. Multiple connected records (OSV, NVD, CNVD, huntr, e...

CVE-2022-0266

CVE-2022-0266 affects livehelperchat (Packagist remdex/livehelperchat) prior to version 3.92. The vulnerability is described as an authorization bypass via a user-controlled key. Multiple connected sources (OSV, CNVD/CNNVD, NVD, CVE lists) consistently reference the same issue and suggest upgradi...

CVE-2022-0395

CVE-2022-0395 is a stored XSS vulnerability in LiveHelperChat (Packagist remdex/livehelperchat) before version 3.93. The issue affects the web application's handling of user-supplied input, enabling attacker-controlled scripts to run in a victim’s browser. Multiple sources (NVD entry, OSV/GHSA ad...

CVE-2022-0935

CVE-2022-0935 affects livehelperchat/livehelperchat prior to 3.97 and is caused by Host Header injection in the password reset flow. Multiple sources (NVD, Red Hat, OSV, CNVD, PT-Security, CNVD) describe an attacker abusing header handling to forge or manipulate password reset tokens, potentially...

CVE-2022-0394

The CVE-2022-0394 entry relates to a stored Cross-site Scripting (XSS) vulnerability in LiveHelperChat (Packagist remdex/livehelperchat). Affected versions are prior to 3.93. Root cause details are not explicitly stated beyond the stored XSS characterization, but multiple connected records confir...

CVE-2022-0226

CVE-2022-0226 affects livehelperchat with CSRF vulnerability. Multiple sources (OSV, GHSA, CVE listing) confirm CSRF in livehelperchat, noting that in at least one advisory the server-side CSRF token validation is missing in audit configuration, allowing actions if the token field is empty. Affec...

CVE-2021-4169

CVE-2021-4169 affects livehelperchat. The vulnerability is an Improper Neutralization of Input During Web Page Generation (XSS) in livehelperchat. Open sources describe reflected/DOM-based XSS vectors enabling injection via user input, with impact limited to client-side script execution and poten...

CVE-2022-0083

livehelperchat is affected by CVE-2022-0083, a vulnerability described as Generation of Error Message Containing Sensitive Information. Multiple connected sources (NVD, OSV, GHSA, CNVD, CNNVD) confirm an information-disclosure issue arising from verbose or leaking error messages, with sources not...

CVE-2022-0231

CSRF vulnerability in livehelperchat (CVE-2022-0231) is documented across multiple sources. The issue arises in the admin file configuration endpoint (/site_admin/file/configuration), where requests can be forged due to missing CSRF token validation. A successful exploit can allow an attacker to ...

CVE-2022-0502

CVE-2022-0502 affects the LiveHelperChat package remdex/livehelperchat. Multiple connected sources confirm a stored Cross-site Scripting (XSS) vulnerability in this package prior to version 3.93. Root cause identified as XSS in the livehelperchat package stored in Packagist. Impact is user-visibl...

CVE-2021-4123

Technical details about CVE-2021-4123 are not publicly available in the provided documents. Monitor for updates from vendors and researchers for affected products, versions, impact, and fixes.

CVE-2021-4132

CVE-2021-4132 affects the LiveHelperChat project. The exposure is a Cross-site Scripting (XSS) flaw described as Improper Neutralization of Input During Web Page Generation, enabling stored XSS in the application. The most concrete details come from multiple connected sources: stored XSS in user ...

CVE-2021-4050

CVE-2021-4050 affects the livehelperchat project and is a Stored Cross-Site Scripting (XSS) vulnerability rooted in improper neutralization of input during web page generation. The issue is triggered via the user’s Account data exposure, specifically in the Photo section where an uploaded SVG (av...

CVE-2021-4177

The CVE-2021-4177 entry relates to livehelperchat and is an information disclosure vulnerability caused by generating error messages that contain sensitive details. Public documents consistently describe the issue as an information leak stemming from error message handling, with no precise affect...

CVE-2021-4131

CVE-2021-4131 affects livehelperchat and describes a Cross-Site Request Forgery (CSRF) vulnerability. The incident is corroborated by multiple sources in the connected documents, which list CSRF as the vulnerability class for livehelperchat and provide CVSS metrics: CVSS v3.1 base score 8.8 (vect...

CVE-2021-4049

CVE-2021-4049 affects livehelperchat with a Cross-Site Request Forgery (CSRF) vulnerability. Public sources (GHSA/Huntr and OSV entries) describe an attacker who can log out a user by causing the user, while logged in, to visit a malicious site; no product/version fix details are provided in the ...

CVE-2021-4179

CVE-2021-4179 affects livehelperchat and is described as a Cross-site Scripting (stored) vulnerability due to Improper Neutralization of Input During Web Page Generation. Several connected sources state the issue originates from how user input is rendered in web pages, enabling injected scripts t...

CVE-2021-4176

CVE-2021-4176 affects livehelperchat and is described across multiple sources as a Cross-site Scripting (XSS) vulnerability caused by Improper Neutralization of Input During Web Page Generation. The connected documents confirm the issue but do not provide concrete affected versions, vendor-specif...

CVE-2017-1000059

Live Helper Chat version 2.06v and older is affected by a Cross‑Site Scripting flaw in HTTP header handling, enabling execution of attacker-supplied JavaScript in another user’s session. Affected: Live Helper Chat; component: HTTP header processing; root cause: improper header data handling. Impa...

CVE-2021-4175

Summary: CVE-2021-4175 affects livehelperchat with a stored Cross-site Scripting (XSS) vulnerability arising from improper neutralization of input during web page generation. Multiple sources (OSV, CNVD, CNNVD, CVE records) corroborate XSS in livehelperchat. Affected component is the web page gen...

CVE-2020-26135

CVE-2020-26135 affects Live Helper Chat prior to version 3.44 and allows a reflected XSS via the setsettingajax PATH_INFO. The available connected docs confirm the vulnerability description but do not provide details on affected exact versions beyond “before 3.44v,” nor do they specify concrete e...

CVE-2025-51397

Live Helper Chat versions ≤4.61 are vulnerable to a stored cross-site scripting (XSS) vulnerability in the Facebook Chat module . The root cause is insufficient validation of the Surname parameter under the Recipient Lists, allowing an attacker to inject a crafted payload. When an administrator o...

CVE-2026-27954

Live Helper Chat is affected up to version 4.52. The flaw arises in three chat action endpoints (holdaction.php, blockuser.php, transferchat.php) which load chat objects by ID without calling erLhcoreClassChat::hasAccessToRead(), enabling operators with holduse, allowblockusers, or allowtransfer ...

CVE-2025-51400

Live Helper Chat versions ≤ 4.61 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists in the Personal Canned Messages feature due to insufficient input validation, allowing an attacker to inject a crafted payload. When an administrator or operator views and attempt...

CVE-2025-51401

A stored cross-site scripting (XSS) vulnerability exists in Live Helper Chat version ≤4.61 (specifically noted in v4.60). The flaw is triggered by insufficient validation of the operator name parameter within the chat transfer function . An attacker can inject a crafted payload into the name fiel...

CVE-2025-51398

Live Helper Chat versions ≤ 4.61 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is the insufficient validation and sanitization of the Name parameter on the Facebook integration page. An attacker can inject a crafted payload into this field, which is then stor...

CVE-2025-51403

Live Helper Chat versions v4.60 and v4.61 are vulnerable to a stored cross-site scripting (XSS) flaw in the department assignment editing module. The root cause is the insufficient validation and lack of sanitization for the Alias Nick parameter. A low-privileged user can inject a malicious JavaS...

CVE-2025-51396

Live Helper Chat versions ≤ 4.61 are vulnerable to a stored cross-site scripting (XSS) vulnerability (CWE-79). The root cause is the insufficient validation of the Telegram Bot Username parameter, which allows an attacker to inject a crafted payload. This payload is stored in the system and execu...