CVE-2026-23752
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality. An authenticated administrator can inject arbitrary JavaScript via the companyname POST parameter without HTML sanitization, and the script executes in the browsers of administrators viewing the Templates > Groups page.
Risk Assessment
Possible execution of malicious script in the context of privileged administrator accounts, risking session hijacking and further attacks.
Recommendation
Update GFI HelpDesk to version 4.99.9 or later. Deploy a Content-Security-Policy and restrict access to the templates functionality.
Other vulnerabilities in GFI HelpDesk
See all- CVE-2026-23758Medium
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field. An authenticated staff member can inject malicious JavaScript via the editsubject POST parameter, bypassing the incomplete SanitizeForXSS() method, and the script executes in the browsers of other staff members or administrators.
- CVE-2026-23757Medium
GFI HelpDesk before 4.99.10 contains a stored XSS vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization. Attackers can inject arbitrary JavaScript into the report title, which executes when staff click the affected report link in Manage Reports.
- CVE-2026-23756Medium
GFI HelpDesk before 4.99.9 contains a stored XSS vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in Controller_Step.InsertSubmit() and EditSubmit() before rendering by View_Step.RenderViewSteps(). An authenticated staff member can inject arbitrary JavaScript into the step subject, which executes when any user clicks the affected step link in Troubleshooter > View Troubleshooter.
- CVE-2026-23753Medium
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality. The charset POST parameter is passed without HTML sanitization to SWIFT_Language::Create() and rendered unsanitized by View_Language.RenderGrid(), allowing an authenticated administrator to inject arbitrary JavaScript.
Original NVD description (English source)
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authenticated administrators to inject arbitrary JavaScript by manipulating the companyname POST parameter without HTML sanitization. Attackers can inject malicious scripts through the companyname field that execute in the browsers of any administrator viewing the Templates > Groups page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS