| CVE-2026-27954 | 中6.5 | Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdaction.php, blockuser.php, and transferchat.php) load chat objects by ID without calling `erLhcoreClassChat::hasAccessToRead()`, allowing operators to act on chats i | 26/02/2026 |
| CVE-2025-51403 | 中6.5 | A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Alias Nick parameter. | 21/07/2025 |
| CVE-2025-51401 | 中5.4 | A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the operator name parameter. | 21/07/2025 |
| CVE-2025-51400 | 中5.4 | A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload. | 21/07/2025 |
| CVE-2025-51398 | 中5.4 | A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter. | 21/07/2025 |
| CVE-2025-51397 | 中5.4 | A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Surname parameter under the Recipient' Lists. | 21/07/2025 |
| CVE-2025-51396 | 中5.4 | A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Telegram Bot Username parameter. | 21/07/2025 |
| CVE-2024-27516 | 緊急9.8 | Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faqweight.php. | 29/02/2024 |
| CVE-2022-1530 | 中6.1 | Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute malicious JavaScript on the application. | 29/04/2022 |
| CVE-2022-0935 | 高8.8 | Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97. | 07/04/2022 |
| CVE-2022-1234 | 中6.1 | XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device. | 06/04/2022 |
| CVE-2022-1235 | 高8.2 | Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96. | 05/04/2022 |
| CVE-2022-1213 | 高8.1 | SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191 | 05/04/2022 |
| CVE-2022-1176 | 高7.5 | Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96. | 31/03/2022 |
| CVE-2022-1191 | 高8.1 | SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96. | 31/03/2022 |
| CVE-2022-0612 | 中5.4 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. | 16/02/2022 |
| CVE-2022-0502 | 中5.4 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. | 06/02/2022 |
| CVE-2022-0395 | 中5.4 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. | 28/01/2022 |
| CVE-2022-0394 | 中5.4 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. | 28/01/2022 |
| CVE-2022-0387 | 中5.4 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. | 27/01/2022 |