Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-51400 — LiveHelperChat <=4.61 - Stored Cross Site Scripting (XSS) via Personal Canned Messages # Date: 09/06/2025 | Kitploit
Tools/GitHubGitHub/thewhiteevil/cve-2025-51400
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration Testing
GitHubthewhiteevil/cve-2025-51400

CVE-2025-51400

LiveHelperChat <=4.61 - Stored Cross Site Scripting (XSS) via Personal Canned Messages # Date: 09/06/2025

View Repository
1 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Exploit Title: LiveHelperChat <=4.61 - Stored Cross Site Scripting (XSS) via Personal Canned Messages

Date: 09/06/2025

Exploit Author: Manojkumar J (TheWhiteEvil)

Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/

Vendor Homepage: https://github.com/LiveHelperChat/livehelperchat/

Software Link:

https://github.com/LiveHelperChat/livehelperchat/

Version: <=4.61

Patched Version: 4.61

Category: Web Application

Tested on: Mac OS Sequoia 15.5, Firefox

CVE : CVE-2025-51400

Exploit link: https://github.com/Thewhiteevil/CVE-2025-51400

Reference: https://livehelperchat.com/4.61v-security-fixes-724a.html

https://github.com/LiveHelperChat/livehelperchat/pull/2228/commits/2056503ad96e04467ec9af8d827109b9b9b46223

A stored cross-site scripting (XSS) vulnerability in Live Helper Chat version ≤ 4.61 allows attackers to execute arbitrary JavaScript by injecting a crafted payload into the Personal Canned Messages. When an admin or operator user views the message, and tries to send canned messages the stored javascript executes in their browser context.

Reproduction Steps:

  1. Log in as an operator.

  2. Navigate to your Personal Canned Messages.

  3. Create new personal canned message, enter the following payload:

    "><img src="https://raw.githubusercontent.com/thewhiteevil/cve-2025-51400/HEAD/x" onerror="prompt(1);">

  4. Save the changes.

  5. Try to use the personal canned message, the cross site scripting (xss) will execute.

    image
Download Tool