CVE-2022-0395

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
livehelperchat	livehelperchat/livehelperchat	>= unspecified, < 3.93v

References

https://github.com/livehelperchat/livehelperchat/commit/8fdb4f67ac1a095331aa0fb4630ef9dfe8e75dcbPatch, Third Party Advisory
https://huntr.dev/bounties/36abbd6e-239e-4739-8c77-ba212b946a4aExploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/livehelperchat/livehelperchat/commit/8fdb4f67ac1a095331aa0fb4630ef9dfe8e75dcbPatch, Third Party Advisory
https://huntr.dev/bounties/36abbd6e-239e-4739-8c77-ba212b946a4aExploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Jan 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-03965.3BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted CVE-2022-03975.4The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it bac CVE-2022-03985.4The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affili CVE-2022-03996.1The Advanced Product Labels for WooCommerce WordPress plugin before 1.2.3.7 does not sanitise and escape the tax_color_set_type parameter be CVE-2022-04007.5An out-of-bounds read vulnerability was discovered in linux kernel in the smc protocol stack, causing remote dos.CVE-2022-04019.8Path Traversal in NPM w-zip prior to 1.0.12.CVE-2022-04026.1The Super Forms - Drag & Drop Form Builder WordPress plugin before 6.0.4 does not escape the bob_czy_panstwa_sprawa_zostala_rozwiazana param CVE-2022-04038.1The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is know to be affected by CVE-2022-04046.5The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notic CVE-2022-04054.3Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.CVE-2022-04064.3Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.CVE-2022-04077.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.