Which versions of LiveHelperChat are affected by CVE-2025-7435?

CVE-2025-7435 is a low-severity vulnerability in LiveHelperChat lhc-php-resque Extension involving cross-site scripting (CVSS 3.5).

Is there a public PoC exploit available for CVE-2025-7435?

Yes, a public proof-of-concept exploit is available for CVE-2025-7435. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-7435?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

LiveHelperChat CVE-2025-7435

Q: What is the CVSS score of CVE-2025-7435?

CVE-2025-7435 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-21100 LOW

Cross-site Scripting (XSS) (CWE-79)

2025-07-11 cna@vuldb.com

XSS

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 26, 2026 - 19:34 vuln.today

CVSS changed

Apr 29, 2026 - 01:11 NVD

3.5 (LOW) 2.0 (LOW)

EUVD ID Assigned

Mar 16, 2026 - 08:17 euvd

EUVD-2025-21100

Analysis Generated

Mar 16, 2026 - 08:17 vuln.today

PoC Detected

Jul 15, 2025 - 13:14 vuln.today

Public exploit code

CVE Published

Jul 11, 2025 - 03:16 cve.org

LOW 2.0

CVE Published

Jul 11, 2025 - 03:16 nvd

LOW 3.5

DescriptionCVE.org

A vulnerability was found in LiveHelperChat lhc-php-resque Extension up to ee1270b35625f552425e32a6a3061cd54b5085c4. It has been classified as problematic. This affects an unknown part of the file /site_admin/lhcphpresque/list/ of the component List Handler. The manipulation of the argument queue name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 542aa8449b5aa889b3a54f419e794afe19f56d5d/0ce7b4f1193c0ed6c6e31a960fafededf979eef2. It is recommended to apply a patch to fix this issue.

AnalysisAI

Reflected cross-site scripting (XSS) in LiveHelperChat lhc-php-resque Extension allows authenticated attackers with low privileges to inject malicious scripts via a crafted queue name parameter, disclosed to the public with proof-of-concept exploit available. Impact is limited to integrity (VI:L), requiring passive user interaction. No active exploitation detected (not in CISA KEV), and EPSS is 0.03%.