Vulnerabilities

TI-2026-32533 CVE-2026-44633

Live Helper Chat: REST API chat update accepts arbitrary chat fields across department boundaries

HIGH 70

Live Helper Chat is an open-source application that enables live support websites.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0027 Published 2026-05-14 Fixed in 4.84v CWE-863

TI-2026-22298 CVE-2026-27954

LiveHelperChat has department-level authorization bypass in holdaction, blockuser, and transferchat endpoints

LOW 28

Live Helper Chat is an open-source application that enables live support websites.

CVSS 4.0MEDIUM 4.9 Network Low privileges No interaction EPSS 0.0022 Published 2026-02-26 No fix listed CWE-862

TI-2026-00291 CVE-2026-0483 · GHSA-g2xg-qw63-fpx3

Stored Cross-Site Scripting (XSS) vulnerability in LiveHelperChat

LOW 30

Stored Cross-Site Scripting (XSS) vulnerability in the PDF file upload functionality of Live Helper Chat, versions prior to 4.72.

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.00289 Published 2026-01-28 Fixed in 4.72 CWE-79

TI-2025-32325 CVE-2025-51403 · GHSA-m4hp-gwc8-p3gj

A stored cross-site scripting (XSS) vulnerability in the department assignment editing…

MEDIUM 62

A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into th…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01583 Published 2025-07-21 No fix listed CWE-79

TI-2025-32324 CVE-2025-51401 · GHSA-f57q-2vg6-g2qp

A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the operator name p…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0097 Published 2025-07-21 No fix listed CWE-79

TI-2025-32323 CVE-2025-51400 · GHSA-7mwh-2gr8-fp7j

A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0097 Published 2025-07-21 No fix listed CWE-79

TI-2025-32322 CVE-2025-51398 · GHSA-hx4h-p78r-mxcr

A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parame…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0097 Published 2025-07-21 No fix listed CWE-79

TI-2025-32321 CVE-2025-51397 · GHSA-jr5r-6hpc-772g

A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Surname parameter…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00996 Published 2025-07-21 No fix listed CWE-779

TI-2025-32320 CVE-2025-51396 · GHSA-m3rh-w8cj-vvpw

A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Telegram Bot Username parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01018 Published 2025-07-21 No fix listed CWE-79

TI-2025-06775 CVE-2025-7435 · GHSA-8jqw-6cf4-5pfv

LiveHelperChat lhc-php-resque Extension List list cross site scripting

MEDIUM 56

A vulnerability was found in LiveHelperChat lhc-php-resque Extension up to ee1270b35625f552425e32a6a3061cd54b5085c4.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00297 Published 2025-07-11 No fix listed CWE-79

TI-2024-18290 CVE-2024-27516 · GHSA-v4cp-2q7v-hg9q

Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v…

HIGH 82

Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faq…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01472 Published 2024-02-28 Fixed in 4.29 CWE-78

TI-2022-01403 CVE-2022-1530 · GHSA-9hgc-wpc5-v8p9

Cross-site Scripting (XSS) in livehelperchat/livehelperchat

LOW 28

Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00651 Published 2022-04-29 Fixed in 3.99v, 3.99 CWE-79

TI-2022-00834 CVE-2022-0935 · GHSA-5f87-fvjm-hrf5

Host Header injection in password Reset in livehelperchat/livehelperchat

MEDIUM 41

Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0134 Published 2022-04-07 Fixed in 3.97 CWE-840

TI-2022-01121 CVE-2022-1234 · GHSA-jmjp-h79x-9f5r

XSS in livehelperchat in livehelperchat/livehelperchat

LOW 28

XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00726 Published 2022-04-06 Fixed in 3.97 CWE-79

TI-2022-01122 CVE-2022-1235 · GHSA-vx8v-g3p3-88vg

Weak secrethash can be brute-forced in livehelperchat/livehelperchat

LOW 36

Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00556 Published 2022-04-05 Fixed in 3.96 CWE-916

TI-2022-01101 CVE-2022-1213 · GHSA-hhr9-7xvh-8xgc

SSRF filter bypass port 80, 433 in livehelperchat/livehelperchat

LOW 36

SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0058 Published 2022-04-05 Fixed in 3.67v, 3.67 CWE-918

TI-2022-01065 CVE-2022-1176 · GHSA-5cmw-fhq9-8fhh

Loose comparison causes IDOR on multiple endpoints in livehelperchat/livehelperchat

LOW 35

Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0125 Published 2022-03-31 Fixed in 3.96 CWE-843

TI-2022-01080 CVE-2022-1191 · GHSA-8m92-98p8-gpmh

SSRF on index.php/cobrowse/proxycss/ in livehelperchat/livehelperchat

LOW 37

SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00955 Published 2022-03-31 Fixed in 3.96 CWE-918

TI-2022-00529 CVE-2022-0612 · GHSA-h2fj-77wh-fh5w