Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
72 results · page 1 of 2
Sep 3, 2026pymonocypher uses cython to wrap the Monocypher C library.CVE-2026-53720 · Other software · jetperch · reported by GitHubMedium 5.1
pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does not check the nb_blocks size. If the caller does not provide a sufficiently large buffer based on the API contract, then argon2i_32 will write past the end of the buffer and possibly corrupt the heap. This issue has been patched in version 4.0.2.8.
- Product
- pymonocypher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Laravel Excel provides supercharged Excel exports and imports in Laravel.CVE-2026-84374 · Other software · SpartnerNL · reported by GitHubHigh 7.5
Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy() method resolves the caller-controlled $destination supplied through Excel::store(), $export->store(), or storeExcel() against the process working directory with realpath() instead of the configured filesystem disk. If the path names an existing writable file, Disk::copy() opens it with fopen() in rb+ mode and uses stream_copy_to_stream(), bypassing Flysystem path confinement and allowing an attacker whose application input controls the export path to overwrite arbitrary existing files with export content. The rb+ behavior creates a non-truncating overwrite and trailing bytes when the new export is shorter, and overwriting an executable PHP file can lead to remote code execution. This issue is fixed in version 3.1.70.
- Product
- Laravel-Excel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2026Powerkit – Supercharge your WordPress Site: Stored Cross-Site ScriptingCVE-2026-15649 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Powerkit – Supercharge your WordPress Site
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Powerkit – Supercharge your WordPress Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Powerkit – Supercharge your WordPress Site: Stored Cross-Site ScriptingCVE-2026-15645 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Powerkit – Supercharge your WordPress Site
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Powerkit – Supercharge your WordPress Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Powerkit – Supercharge your WordPress Site: Stored Cross-Site ScriptingCVE-2026-15644 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Powerkit – Supercharge your WordPress Site
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Powerkit – Supercharge your WordPress Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 14, 2026Live Helper Chat is an open-source application that enables live support websites.CVE-2026-44633 · Other software · LiveHelperChat · reported by GitHubHigh 8.1
Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST API chat update endpoint allows a REST user with lhchat/use to update a chat in a department they cannot read. The endpoint accepts arbitrary chat object fields, so the user can change the chat hash and status and then access or tamper with the chat through visitor/widget paths. The same write primitive can set operation_admin, which is later emitted as operator-side JavaScript.
- Product
- livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026A vulnerability was identified in BigSweetPotatoStudio HyperChat up to 2.0.0-alpha.63.CVE-2026-7223 · Other software · BigSweetPotatoStudio · reported by VulDBMedium 5.5
A vulnerability was identified in BigSweetPotatoStudio HyperChat up to 2.0.0-alpha.63. Affected by this issue is the function fetch of the file packages/core/src/http/aiProxyMiddleware.mts of the component AI Proxy Middleware. Such manipulation of the argument baseurl leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- HyperChat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Live Helper Chat is an open-source application that enables live support websites.CVE-2026-27954 · Other software · LiveHelperChat · reported by GitHubMedium 4.9
Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdaction.php, blockuser.php, and transferchat.php) load chat objects by ID without calling `erLhcoreClassChat::hasAccessToRead()`, allowing operators to act on chats in departments they are not assigned to. Operators with the relevant role permissions (holduse, allowblockusers, allowtransfer) can hold, block users from, or transfer chats in departments they are not assigned to. This is a horizontal privilege escalation within one organization. As of time of publication, no known patched versions are available.
- Product
- livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Stored Cross-Site Scripting (XSS) vulnerability in the PDF file upload functionality of Live Helper Chat, versions prior to 4.72.CVE-2026-0483 · Other software · LiveHelperChat · reported by cve-coordination@incibe.esMedium 6.9
Stored Cross-Site Scripting (XSS) vulnerability in the PDF file upload functionality of Live Helper Chat, versions prior to 4.72. An attacker can upload a malicious PDF file containing an XSS payload, which will be executed in the user's context when they download and open the file via the link generated by the application. The vulnerability allows arbitrary JavaScript code to be executed in the user's local context.
- Product
- LiveHelperChat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026A stored Cross-Site Scripting (XSS) vulnerability exists in Perch CMS version 3.2.CVE-2025-66686 · Other software · Grabaperch · reported by MITREMedium 6.1
A stored Cross-Site Scripting (XSS) vulnerability exists in Perch CMS version 3.2. An authenticated attacker with administrative privileges can inject malicious JavaScript code into the “Help button url” setting within the admin panel. The injected payload is stored and executed when any authenticated user clicks the Help button, potentially leading to session hijacking, information disclosure, privilege escalation, and unauthorized administrative actions.
- Product
- Perch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025Perch CMS 3.2 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript.CVE-2023-53890 · Other software · Perch · reported by VulnCheckMedium 5.1
Perch CMS 3.2 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript. Attackers can craft SVG files with script tags that execute when the file is viewed, potentially stealing user session information or performing client-side attacks.
- Product
- Perch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrabaperch.comexploit-db.com
Dec 15, 2025Perch CMS 3.2 contains a remote code execution vulnerability that allows authenticated administrators to upload arbitrary PHP files through the assets managemenCVE-2023-53889 · Other software · Perch · reported by VulnCheckHigh 8.6
Perch CMS 3.2 contains a remote code execution vulnerability that allows authenticated administrators to upload arbitrary PHP files through the assets management interface. Attackers can upload a malicious .phar file with embedded system command execution capabilities to execute arbitrary commands on the server.
- Product
- Perch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrabaperch.comexploit-db.com
Jul 21, 2025A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitraryCVE-2025-51403 · Other software · Livehelperchat · reported by MITREMedium 6.5
A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Alias Nick parameter.
- Product
- Live Helper Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HCVE-2025-51401 · Other software · Livehelperchat · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the operator name parameter.
- Product
- Live Helper Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts orCVE-2025-51400 · Other software · Livehelperchat · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
- Product
- Live Helper Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts CVE-2025-51398 · Other software · Livehelperchat · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.
- Product
- Live Helper Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTMCVE-2025-51397 · Other software · Livehelperchat · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Surname parameter under the Recipient' Lists.
- Product
- Live Helper Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted paCVE-2025-51396 · Other software · Livehelperchat · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Telegram Bot Username parameter.
- Product
- Live Helper Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025A vulnerability was found in LiveHelperChat lhc-php-resque Extension up to ee1270b35625f552425e32a6a3061cd54b5085c4.CVE-2025-7435 · Other software · LiveHelperChat · reported by VulDBLow 2
A vulnerability was found in LiveHelperChat lhc-php-resque Extension up to ee1270b35625f552425e32a6a3061cd54b5085c4. It has been classified as problematic. This affects an unknown part of the file /site_admin/lhcphpresque/list/ of the component List Handler. The manipulation of the argument queue name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 542aa8449b5aa889b3a54f419e794afe19f56d5d/0ce7b4f1193c0ed6c6e31a960fafededf979eef2. It is recommended to apply a patch to fix this issue.
- Product
- lhc-php-resque Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025An issue in KeeperChat IOS Application v.5.8.8 allows a physically proximate attacker to escalate privileges via the Biometric Authentication ModuleCVE-2025-29627 · Other software · Keepersecurity · reported by MITREMedium 6.8
An issue in KeeperChat IOS Application v.5.8.8 allows a physically proximate attacker to escalate privileges via the Biometric Authentication Module
- Product
- Keeperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comkeepersecurity.com
May 15, 2024If misconfigured, alpitronic Hypercharger EV charging devices can expose a web interface protected by authentication.CVE-2024-4622 · Other software · alpitronic · reported by ics-cert@hq.dhs.govHigh 8.3
If misconfigured, alpitronic Hypercharger EV charging devices can expose a web interface protected by authentication. If the default credentials are not changed, an attacker can use public knowledge to access the device as an administrator.
- Product
- Hypercharger EV Charger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govindustrydecarbonization.com
Apr 6, 2024Powerkit – Supercharge your WordPress Site: Stored Cross-Site ScriptingCVE-2024-2458 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Powerkit – Supercharge your WordPress Site
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update Powerkit – Supercharge your WordPress Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 28, 2024Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive inforCVE-2024-27516 · Other software · livehelperchat · reported by MITRECritical 9.8
Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faqweight.php.
- Product
- livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2023KnowBand supercheckout > 5.0.7 and < 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type.CVE-2023-45384 · Other software · knownband · reported by MITRECritical 9.8
KnowBand supercheckout > 5.0.7 and < 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the module "Module One Page Checkout, Social Login & Mailchimp" (supercheckout), a guest can upload files with extensions .php
- Product
- supercheckout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaddons.prestashop.comsecurity.friendsofpresta.org
Oct 5, 2023SQL injection vulnerability in KnowBand Module One Page Checkout, Social Login & Mailchimp (supercheckout) v.8.0.3 and before allows a remote attacker to executCVE-2023-44024 · Other software · Knowband · reported by MITRECritical 9.8
SQL injection vulnerability in KnowBand Module One Page Checkout, Social Login & Mailchimp (supercheckout) v.8.0.3 and before allows a remote attacker to execute arbitrary code via a crafted request to the updateCheckoutBehaviour function in the supercheckout.php component.
- Product
- ONE Page Checkout, Social Login & Mailchimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
May 2, 2022SiteSuperCharger: Does not validateCVE-2022-0771 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SiteSuperCharger WordPress plugin before 5.2.0 does not validate, sanitise and escape various user inputs before using them in SQL statements via AJAX actions (available to both unauthenticated and authenticated users), leading to Unauthenticated SQL Injections
- Product
- SiteSuperCharger
- Fixed in
- 5.2.0
- What to do
- Update SiteSuperCharger to 5.2.0 or newer.
Apr 29, 2022Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v.CVE-2022-1530 · Other software · livehelperchat · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute malicious JavaScript on the application.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2022Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.CVE-2022-0935 · Other software · livehelperchat · reported by security@huntr.devHigh 8.8
Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2022XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97.CVE-2022-1234 · Other software · livehelperchat · reported by security@huntr.devMedium 6.1
XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96.CVE-2022-1235 · Other software · livehelperchat · reported by security@huntr.devHigh 8.2
Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v.CVE-2022-1213 · Other software · livehelperchat · reported by security@huntr.devHigh 8.1
SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96.CVE-2022-1176 · Other software · livehelperchat · reported by security@huntr.devHigh 7.5
Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96.CVE-2022-1191 · Other software · livehelperchat · reported by security@huntr.devHigh 8.1
SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0612 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0502 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0395 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0394 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0387 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0370 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0375 · Other software · livehelperchat · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0374 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2022Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.CVE-2022-0266 · Other software · livehelperchat · reported by security@huntr.devMedium 6.6
Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0.CVE-2022-0245 · Other software · livehelperchat · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2022livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2022-0253 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2022-0226 · Other software · livehelperchat · reported by security@huntr.devMedium 4.3
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2022-0231 · Other software · livehelperchat · reported by security@huntr.devMedium 6.5
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2022livehelperchat is vulnerable to Generation of Error Message Containing Sensitive InformationCVE-2022-0083 · Other software · livehelperchat · reported by security@huntr.devMedium 5.3
livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2021livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4176 · Other software · livehelperchat · reported by security@huntr.devMedium 6.1
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2021livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4175 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2021livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4179 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.