livehelperchat Server-Side Template Injection

CRITICAL 9.8CVE-2024-27516 · GHSA-v4cp-2q7v-hg9q · Published 29/02/2024 · updated 17/06/2026

In short

CVE-2024-27516 is a CRITICAL (CVSS 9.8) vulnerability affecting remdex/livehelperchat, live helper chat (livehelperchat).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 73.8% of all vulnerabilities.
Fix: update to 4.29, 4.34 or later.

Package	Affected versions	Patched versions
remdex/livehelperchat Packagist	`< 4.29`	`4.29`
live helper chat livehelperchat	`< 4.34`	`4.34`

Description

Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faqweight.php.

NVD description

Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faqweight.php.

References

nvd.nist.gov/vuln/detail/CVE-2024-27516 · ADVISORY
LiveHelperChat/livehelperchat · WEB
LiveHelperChat/livehelperchat commit a61d231 · WEB
LiveHelperChat/livehelperchat · PACKAGE

More vulnerabilities in remdex/livehelperchat

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

remdex/livehelperchat

Packagist

< 4.29

4.29

live helper chat

livehelperchat

< 4.34

4.34

Description

NVD description

More vulnerabilities in remdex/livehelperchat

See all →