Livezilla's vulnerability profile centers on a single, customer-communication and live-chat platform that, despite a narrow product scope, is deployed across a broad base of customer-facing websites and support operations. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity and a strong tendency toward public exploit availability, reflecting the product's exposure in the web-application tier and the appeal of input-handling flaws to attack developers. The exposure recurs consistently through application-layer weakness classes including cross-site scripting, SQL injection, code injection, path traversal, and resource-exhaustion conditions, which are characteristic of web platforms that process and reflect untrusted user input without adequate validation or encoding. Defenders should treat Livezilla advisories as high-priority for any deployed instance and maintain vigilant patching discipline on this customer-facing component; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Livezilla over time
Signals from CVEs in this vendor scope (21 CVEs).
21 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2013-6225CRITICAL LiveZilla 5.0.1.4 has a Remote Code Execution vulnerability | Jan 13, 2020 | 9.8 | 48 | NO | YES |
CVE-2019-12962MEDIUM LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header. | Jun 25, 2019 | 6.1 | 44 | NO | YES |
CVE-2020-9758CRITICAL An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 (Helpdesk). A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and p | Mar 9, 2020 | 9.6 | 30 | NO | NO |
CVE-2019-12960CRITICAL LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in functions.internal.build.inc.php via the parameter p_dt_s_d. | Jun 25, 2019 | 9.8 | 30 | NO | NO |
CVE-2019-12939CRITICAL LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in server.php via the p_ext_rse parameter. | Jun 24, 2019 | 9.8 | 29 | NO | NO |
CVE-2019-12961HIGH LiveZilla Server before 8.0.1.1 is vulnerable to CSV Injection in the Export Function. | Jun 25, 2019 | 8.8 | 27 | NO | NO |
CVE-2010-4276MEDIUM Cross-site scripting (XSS) vulnerability in the lz_tracking_set_sessid function in templates/jscript/jstrack.tpl in LiveZilla 3.2.0.2 allows remote attackers to inject arbitrary we | Dec 30, 2010 | 4.3 | 26 | NO | YES |
CVE-2013-7034HIGH The setCookieValue function in _lib/functions.global.inc.php in LiveZilla before 5.1.2.1 allows remote attackers to execute arbitrary PHP code via a serialized PHP object in a cook | May 5, 2014 | 7.5 | 24 | NO | NO |
CVE-2013-7385MEDIUM LiveZilla 5.1.2.1 and earlier includes the MD5 hash of the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php, which allows remote attackers | May 19, 2014 | 6.8 | 22 | NO | NO |
CVE-2009-4450MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in map.php in LiveZilla 3.1.8.3 allow remote attackers to inject arbitrary web script or HTML via the (1) lat, (2) lng, and (3) | Dec 29, 2009 | 4.3 | 22 | NO | YES |
Signals from CVEs in this vendor scope (21 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Livezilla.
Media articles that mention a CVE ID that affects a product developed by Livezilla — matched by CVE ID, not by vendor name.