Livehelperchat Live Helper Chat vulnerabilities

CVE-2025-51403 [MEDIUM] CWE-79 CVE-2025-51403: A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Alias Nick parameter.

CVE-2021-4169 [MEDIUM] CWE-79 CVE-2021-4169: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross- livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-27516 [CRITICAL] CWE-78 CVE-2024-27516: Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote at Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faqweight.php.

CVE-2025-51400 [MEDIUM] CWE-79 CVE-2025-51400: A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Cha A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.

CVE-2025-51401 [MEDIUM] CWE-79 CVE-2025-51401: A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the operator name parameter.

CVE-2025-51396 [MEDIUM] CWE-79 CVE-2025-51396: A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to exec A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Telegram Bot Username parameter.

CVE-2025-51398 [MEDIUM] CWE-79 CVE-2025-51398: A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper C A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.

CVE-2025-51397 [MEDIUM] CWE-779 CVE-2025-51397: A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4 A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Surname parameter under the Recipient' Lists.

CVE-2022-1213 [HIGH] CVE-2022-1213: SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. A SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191

CVE-2022-0935 [HIGH] CWE-840 CVE-2022-0935: Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.

CVE-2022-1191 [HIGH] CWE-918 CVE-2022-1191: SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.9 SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96.

CVE-2026-27954 [MEDIUM] CWE-862 CVE-2026-27954: Live Helper Chat is an open-source application that enables live support websites. In versions up to Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdaction.php, blockuser.php, and transferchat.php) load chat objects by ID without calling `erLhcoreClassChat::hasAccessToRead()`, allowing operators to act on chats in departments they are not assig

CVE-2022-1176 [HIGH] CWE-843 CVE-2022-1176: Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelpercha Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96.

CVE-2022-1235 [HIGH] CWE-916 CVE-2022-1235: Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96 Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96.

CVE-2021-4131 [HIGH] CWE-352 CVE-2021-4131: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2022-0266 [MEDIUM] CWE-639 CVE-2022-0266: Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v. Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.

CVE-2022-0231 [MEDIUM] CWE-352 CVE-2022-0231: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2021-4123 [MEDIUM] CWE-352 CVE-2021-4123: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2022-1234 [MEDIUM] CWE-79 CVE-2022-1234: XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnera XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device.

CVE-2021-4049 [MEDIUM] CWE-352 CVE-2021-4049: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)