livehelperchat 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
一般的な弱点パターンには vendor risk cross-site scripting、vendor risk csrf, and vendor risk ssrf があり、vendor surface production workloads and vendor surface software deployment の利用場面で vendor impact session compromise などのリスクが生じる可能性があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2026-27954 | Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdaction.php, blockuser.php, and transferchat.php) load chat objects by ID without calling `erLhcoreClassChat::hasAccessToRead()`, allowing operators to act on chats in departments they are not assigned to. Operators with the relevant role permissions (holduse, allowblockusers, allowtransfer) can hold, block users from, or transfer chats in depa | [email protected] | 4.9 | 0.03% | 2026-02-26 | 2026-02-28 |
| CVE-2025-51403 | A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Alias Nick parameter. | [email protected] | 6.5 | 0.64% | 2025-07-21 | 2025-08-07 |
| CVE-2025-51401 | A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the operator name parameter. | [email protected] | 5.4 | 0.57% | 2025-07-21 | 2025-08-07 |
| CVE-2025-51400 | A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload. | [email protected] | 5.4 | 0.57% | 2025-07-21 | 2025-08-07 |
| CVE-2025-51398 | A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter. | [email protected] | 5.4 | 0.57% | 2025-07-21 | 2025-08-07 |
| CVE-2025-51397 | A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Surname parameter under the Recipient' Lists. | [email protected] | 5.4 | 0.82% | 2025-07-21 | 2025-08-07 |
| CVE-2025-51396 | A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Telegram Bot Username parameter. | [email protected] | 5.4 | 0.57% | 2025-07-21 | 2025-08-07 |
| CVE-2024-27516 | Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faqweight.php. | [email protected] | 9.8 | 3.18% | 2024-02-29 | 2025-04-30 |
| CVE-2022-1530 | Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute malicious JavaScript on the application. | [email protected] | 6.1 | 0.21% | 2022-04-29 | 2024-11-21 |
| CVE-2022-0935 | Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97. | [email protected] | 8.8 | 0.40% | 2022-04-07 | 2024-11-21 |
| CVE-2022-1234 | XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device. | [email protected] | 6.1 | 0.13% | 2022-04-06 | 2024-11-21 |
| CVE-2022-1235 | Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96. | [email protected] | 8.2 | 0.12% | 2022-04-05 | 2024-11-21 |
| CVE-2022-1213 | SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191 | [email protected] | 8.1 | 0.10% | 2022-04-05 | 2024-11-21 |
| CVE-2022-1176 | Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96. | [email protected] | 7.5 | 0.27% | 2022-03-31 | 2024-11-21 |
| CVE-2022-1191 | SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96. | [email protected] | 8.1 | 0.15% | 2022-03-31 | 2024-11-21 |
| CVE-2022-0612 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. | [email protected] | 5.4 | 0.30% | 2022-02-16 | 2024-11-21 |
| CVE-2022-0502 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. | [email protected] | 5.4 | 0.38% | 2022-02-06 | 2024-11-21 |
| CVE-2022-0395 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. | [email protected] | 5.4 | 0.38% | 2022-01-28 | 2024-11-21 |
| CVE-2022-0394 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. | [email protected] | 5.4 | 0.26% | 2022-01-28 | 2024-11-21 |
| CVE-2022-0387 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. | [email protected] | 5.4 | 0.28% | 2022-01-27 | 2024-11-21 |