Security issues should be reported directly to me to remdex@gmail.com or info@livehelperchat.com. You can also just ping me on discord server https://discord.gg/YsZXQVh
Repository navigation
Security: LiveHelperChat/livehelperchat
Security
.github/SECURITY.md
-
Authorization bypass exposes private group chat conversationsGHSA-jghw-3h56-x7r4 published
Oct 14, 2026 by remdexModerate -
Stored Cross-Site Scripting in the operator back-office via the visitor pre-chat "E-mail" fieldGHSA-h3pm-8383-3p28 published
Oct 14, 2026 by remdexModerate -
Non-Expiring Session Tokens Without IP Binding in lhrestapi/loginbytoken.php (CWE-287)GHSA-cwpv-hp73-hj82 published
Oct 12, 2026 by remdexCritical -
Unauthenticated Reflected URL Injection in lhfile/downloadfile.php modal=external (CWE-306/CWE-79)GHSA-p4w9-wqp2-hmgg published
Oct 12, 2026 by remdexHigh -
Reflection-Based Invocation of Arbitrary Class Static Methods in lhwebhooks/dispatch.php (CWE-470/CWE-502)GHSA-x9m6-qx6j-hpxm published
Oct 12, 2026 by remdexHigh -
Stored XSS via unfiltered [html] BBCode in startchat questionGHSA-2vc6-m33r-8v36 published
Oct 12, 2026 by remdexHigh -
Department assignment for any account via user/newdepartmentGHSA-gxmc-38j6-m839 published
Oct 12, 2026 by remdexHigh -
Password change invalidates no session and no remember-me tokenGHSA-x2h4-pg9f-mj6x published
Oct 12, 2026 by remdexHigh -
javascript: URL in the operator online visitors view via logpageviewGHSA-8r7c-6p3q-rwgr published
Oct 12, 2026 by remdexModerate -
Stored XSS in the visitor chat renderer via [html_snippet] BBCodeGHSA-x6rp-3gq8-6q47 published
Oct 12, 2026 by remdexModerate
Learn more about advisories related to LiveHelperChat/livehelperchat in the GitHub Advisory Database