LiveHelperChat vulnerabilities
We track 3 vulnerabilities in LiveHelperChat products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on May 14, 2026.
Latest LiveHelperChat vulnerabilities
- 8.1 High severity
livehelperchat: Incorrect Authorization
Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST API chat update endpoint allows a REST user with lhchat/use to update a chat in a department they cannot read. The endpoint accepts arbitrary
- 9.8 Critical severity
livehelperchat: Improper Neutralization of Special Elements used in an OS Command
Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faqweight.php.
- 8.1 High severity
livehelperchat/livehelperchat: Server-Side Request Forgery
SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191