CVE-2026-23757
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
GFI HelpDesk before 4.99.10 contains a stored XSS vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization. Attackers can inject arbitrary JavaScript into the report title, which executes when staff click the affected report link in Manage Reports.
Risk Assessment
An authenticated attacker can execute arbitrary JavaScript in staff browsers, potentially hijacking sessions or performing actions on behalf of victims.
Recommendation
Update GFI HelpDesk to version 4.99.10 or later.
Other vulnerabilities in GFI HelpDesk
See all- CVE-2026-23758Medium
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field. An authenticated staff member can inject malicious JavaScript via the editsubject POST parameter, bypassing the incomplete SanitizeForXSS() method, and the script executes in the browsers of other staff members or administrators.
- CVE-2026-23756Medium
GFI HelpDesk before 4.99.9 contains a stored XSS vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in Controller_Step.InsertSubmit() and EditSubmit() before rendering by View_Step.RenderViewSteps(). An authenticated staff member can inject arbitrary JavaScript into the step subject, which executes when any user clicks the affected step link in Troubleshooter > View Troubleshooter.
- CVE-2026-23753Medium
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality. The charset POST parameter is passed without HTML sanitization to SWIFT_Language::Create() and rendered unsanitized by View_Language.RenderGrid(), allowing an authenticated administrator to inject arbitrary JavaScript.
- CVE-2026-23752Medium
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality. An authenticated administrator can inject arbitrary JavaScript via the companyname POST parameter without HTML sanitization, and the script executes in the browsers of administrators viewing the Templates > Groups page.
Original NVD description (English source)
GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization. Attackers can inject arbitrary JavaScript into the report title field when creating or editing a report, and the payload executes when staff members view and click the affected report link in the Manage Reports interface.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS