CVE-2022-1234Active Exploitation(livehelperchat / live_helper_chat)

MEDIUMCVSS 6.1 · MEDIUM

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for livehelperchat live_helper_chat systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device.

livehelperchat CVEs Back to dashboard

5.5/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Weakness type (CWE)

CWE-79

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

live_helper_chat

Threat summary

Active exploitation appears in 3 classified signals
Exploit tooling references are present in monitored signal
4 mentions across 3 observed days
Momentum state: stable

What's happening

Active exploitation reported across 3 signals
Exploit tool or code specified in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 2 mentions (2026-02-28); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

livehelperchat

Products

live_helper_chat

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Active Exploitation

375.0%

Disclosure

125.0%

Referenced assets1 URL

By indicator

https://ift.tt/oNDzVTW

Classification over time

Date	Total	Labels

2026-02-27	1	Active Exploitation1
2026-02-28	2	Active Exploitation1Disclosure1
2026-03-01	1	Active Exploitation1

Full discourse4 posts

Anonymous Tech@Anonymous_Tech7222d
Active Exploitation
**U.S. FINANCIAL SECTOR** compromised via phishing vector, exploiting CVE-2022-1234, linked to FANCY BEAR. Malicious IP 185.35.71.103, hash 4f5a2d3c, deployed LOCKBIT ransomware.
Post summary
The post reports a phishing-based compromise targeting CVE-2022-1234 in the U.S. financial sector, confirming active exploitation with no PoC or patch details provided.
0001095
1 followersView on X
Anonymous Tech@Anonymous_Tech7222d
Active Exploitation
**GLOBAL AI NETWORK** compromised via open-source hosts, enabling resource hijacking and code execution attacks, potentially attributed to FANCY BEAR, exploiting CVE-2022-1234, IP 185.125.169.137.
Post summary
The text indicates that CVE-2022-1234 is actively exploited by FANCY BEAR against GLOBAL AI NETWORK, enabling resource hijacking and code execution.
0001054
1 followersView on X
Anonymous Tech@Anonymous_Tech7221d
Active Exploitation
**U.S. FINANCIAL SECTOR** compromised via malicious Chrome extension "QuickLens" using CVE-2022-1234, linked to FANCY BEAR, stealing crypto from thousands of users with malware payload 74a34321.
Post summary
A malicious Chrome extension "QuickLens" exploited CVE‑2022‑1234 to compromise the U.S. financial sector, stealing cryptocurrency from thousands of users.
0000048
1 followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash222d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-2647 - CVE-2022-1234: Apache HTTP Server Remote Code Execution Vulnerability Intel Report: https://ift.tt/oNDzVTW
Post summary
The alert announces a remote code execution vulnerability in Apache HTTP Server (CVE-2026-2647 and CVE-2022-1234) and provides a link to an Intel report.
0000022
341 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	livehelperchat	live_helper_chat	-	-	-

Explore more

Back to dashboard livehelperchat CVEs live_helper_chat vulnerabilities

What researchers are saying

CVE-2022-1234

Anonymous Tech@Anonymous_Tech7Active Exploitation

The post reports a phishing-based compromise targeting CVE-2022-1234 in the U.S. financial sector, confirming active exploitation with no PoC or patch details provided.

Anonymous Tech@Anonymous_Tech7Active Exploitation

The text indicates that CVE-2022-1234 is actively exploited by FANCY BEAR against GLOBAL AI NETWORK, enabling resource hijacking and code execution.

Anonymous Tech@Anonymous_Tech7Active Exploitation

A malicious Chrome extension "QuickLens" exploited CVE‑2022‑1234 to compromise the U.S. financial sector, stealing cryptocurrency from thousands of users.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

The alert announces a remote code execution vulnerability in Apache HTTP Server (CVE-2026-2647 and CVE-2022-1234) and provides a link to an Intel report.