PT-2026-4814 · Unknown · Livehelperchat

CVE-2026-0483 · Publicado 2026-01-26 · Atualizado 2026-01-28

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Live Helper Chat versions prior to 4.72

Description A stored Cross-Site Scripting (XSS) issue exists in the PDF file upload functionality. An attacker can upload a malicious PDF file containing an XSS payload. When a user downloads and opens the file through a link generated by the application, the payload is executed in the user’s context, allowing arbitrary JavaScript code to run locally.

Recommendations Update Live Helper Chat to version 4.72 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-0483

Produtos afetados

Livehelperchat

Referências · 6

• https://twitter.com/incibe_cert/status/2015762165928468929 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2016480867422515288 · Publicação no Twitter
• https://incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-vulnerability-livehelperchat · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-0483 · Nota de Segurança
• https://t.me/cveNotify/150124 · Publicação no Telegram
• https://t.me/CVEtracker/43133 · Publicação no Telegram