livehelperchat - MidnightBSD Security Advisories

CVE-2017-1000059 MEDIUM

Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any user provided Javascript code in the session of other users.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2020-26134 MEDIUM

Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via BBCode.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2020-26135 MEDIUM

Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2021-4049 MEDIUM

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	2.8	3.6

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-352,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2021-4050 MEDIUM

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	-

CVE-2021-4123 MEDIUM

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N	2.8	3.6

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-352,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2021-4131 MEDIUM

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-352,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2021-4132 LOW

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

CVSS 2.0

Severity: LOW

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2021-4169 MEDIUM

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2021-4175 LOW

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

CVSS 2.0

Severity: LOW

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2021-4176 MEDIUM

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2021-4177 MEDIUM

livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-209,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2021-4179 LOW

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

CVSS 2.0

Severity: LOW

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2022-0083 MEDIUM

livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-209,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2022-0226 MEDIUM

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	2.8	1.4

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-352,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2022-0231 MEDIUM

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N	2.8	3.6

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-352,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2022-0245 MEDIUM

Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	2.8	1.4

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-352,

Products Affected

Vendor	Product	Version
livehelperchat	livehelperchat	*

CVE-2022-0253 LOW

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

CVSS 2.0

Severity: LOW

Problem Type: CWE-79,CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	livehelperchat	*

CVE-2022-0266 MEDIUM

Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	6.6	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H	0.7	5.9

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-639,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2022-0370 LOW

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

CVSS 2.0

Severity: LOW

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	livehelperchat	*

CVE-2022-0374 LOW

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

CVSS 2.0

Severity: LOW

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2022-0375 LOW

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	4.8	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	1.7	2.7

CVSS 2.0

Severity: LOW

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2022-0387 LOW

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

CVSS 2.0

Severity: LOW

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	livehelperchat	*

CVE-2022-0394 LOW

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

CVSS 2.0

Severity: LOW

Problem Type: CWE-79,CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2022-0395 LOW

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

CVSS 2.0

Severity: LOW

Problem Type: CWE-79,CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2022-0502 LOW

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

CVSS 2.0

Severity: LOW

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2022-0612 LOW

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

CVSS 2.0

Severity: LOW

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2022-0935 MEDIUM

Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-840,CWE-116,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2022-1176 MEDIUM

Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-843,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2022-1191 MEDIUM

SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	8.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N	2.8	5.2

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-918,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2022-1213 MEDIUM

SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	8.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N	2.8	5.2

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-918,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2022-1234 MEDIUM

XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2022-1235 MEDIUM

Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	8.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N	3.9	4.2

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-916,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2022-1530 MEDIUM

Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute malicious JavaScript on the application.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,CWE-79,

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2024-27516

Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faqweight.php.

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2025-51396

A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Telegram Bot Username parameter.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2025-51397

A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Surname parameter under the Recipient' Lists.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2025-51398

A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2025-51400

A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2025-51401

A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the operator name parameter.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2025-51403

A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Alias Nick parameter.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
134c704f-9b21-4f2e-91b3-4a467353bcc0	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	2.8	3.6

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

CVE-2026-27954

Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdaction.php, blockuser.php, and transferchat.php) load chat objects by ID without calling `erLhcoreClassChat::hasAccessToRead()`, allowing operators to act on chats in departments they are not assigned to. Operators with the relevant role permissions (holduse, allowblockusers, allowtransfer) can hold, block users from, or transfer chats in departments they are not assigned to. This is a horizontal privilege escalation within one organization. As of time of publication, no known patched versions are available.

Products Affected

Vendor	Product	Version
livehelperchat	live_helper_chat	*

Advisories for livehelperchat