Search
Search Results (6 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-27954 | 1 Livehelperchat | 2 Live Helper Chat, Livehelperchat | 2026-06-17 | 6.5 Medium |
| Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdaction.php, blockuser.php, and transferchat.php) load chat objects by ID without calling `erLhcoreClassChat::hasAccessToRead()`, allowing operators to act on chats in departments they are not assigned to. Operators with the relevant role permissions (holduse, allowblockusers, allowtransfer) can hold, block users from, or transfer chats in departments they are not assigned to. This is a horizontal privilege escalation within one organization. As of time of publication, no known patched versions are available. | ||||
| CVE-2017-1000059 | 1 Livehelperchat | 1 Live Helper Chat | 2025-04-20 | N/A |
| Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any user provided Javascript code in the session of other users. | ||||
| CVE-2022-0231 | 1 Livehelperchat | 1 Live Helper Chat | 2024-11-21 | 6.5 Medium |
| livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) | ||||
| CVE-2022-0226 | 1 Livehelperchat | 1 Live Helper Chat | 2024-11-21 | 4.3 Medium |
| livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) | ||||
| CVE-2020-26135 | 1 Livehelperchat | 1 Live Helper Chat | 2024-11-21 | 6.1 Medium |
| Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO. | ||||
| CVE-2020-26134 | 1 Livehelperchat | 1 Live Helper Chat | 2024-11-21 | 6.1 Medium |
| Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via BBCode. | ||||
Page 1 of 1.