CVE-2026-23753
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality. The charset POST parameter is passed without HTML sanitization to SWIFT_Language::Create() and rendered unsanitized by View_Language.RenderGrid(), allowing an authenticated administrator to inject arbitrary JavaScript.
Risk Assessment
The malicious script executes in the browser of any administrator viewing the Languages page, potentially leading to hijacking of a privileged account session.
Recommendation
Update GFI HelpDesk to version 4.99.9 or later. Limit administrative accounts and deploy a Content-Security-Policy.
Other vulnerabilities in GFI HelpDesk
See all- CVE-2026-23758Medium
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field. An authenticated staff member can inject malicious JavaScript via the editsubject POST parameter, bypassing the incomplete SanitizeForXSS() method, and the script executes in the browsers of other staff members or administrators.
- CVE-2026-23757Medium
GFI HelpDesk before 4.99.10 contains a stored XSS vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization. Attackers can inject arbitrary JavaScript into the report title, which executes when staff click the affected report link in Manage Reports.
- CVE-2026-23756Medium
GFI HelpDesk before 4.99.9 contains a stored XSS vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in Controller_Step.InsertSubmit() and EditSubmit() before rendering by View_Step.RenderViewSteps(). An authenticated staff member can inject arbitrary JavaScript into the step subject, which executes when any user clicks the affected step link in Troubleshooter > View Troubleshooter.
- CVE-2026-23752Medium
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality. An authenticated administrator can inject arbitrary JavaScript via the companyname POST parameter without HTML sanitization, and the script executes in the browsers of administrators viewing the Templates > Groups page.
Original NVD description (English source)
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality where the charset POST parameter is passed directly to SWIFT_Language::Create() without HTML sanitization and subsequently rendered unsanitized by View_Language.RenderGrid(). An authenticated administrator can inject arbitrary JavaScript through the charset field when creating or editing a language, and the payload executes in the browser of any administrator viewing the Languages page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS