CVE-2013-7385: LiveZilla 5.1.2.1 and earlier includes the MD5 hash of the operator password in plaintext in Javascript cod...

Security readout for executives and security teams

LiveZilla 5.1.2.1 and earlier exposed an operator password MD5 hash inside JavaScript generated by a mobile chat endpoint. An attacker would also need a separate XSS path to read the exposed variables, but successful access could help them gain LiveZilla operator privileges. Exposure is most likely on internet-facing LiveZilla deployments running 5.1.2.1 or earlier, especially where the mobile chat endpoint is reachable and XSS risk exists elsewhere in the application or surrounding site. Prioritize identification and remediation for any public LiveZilla deployment. The issue is old and lacks a cited active-exploitation signal, but it directly exposes password-derived material and can support privilege gain when paired with XSS. Mitigation focus: Inventory LiveZilla instances and identify versions 5.1.2.1 or earlier.; Check LiveZilla vendor guidance for a fixed release or supported upgrade path.; Restrict external access to lz/mobile/chat.php where business operations allow..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.