CVE-2026-23758
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field. An authenticated staff member can inject malicious JavaScript via the editsubject POST parameter, bypassing the incomplete SanitizeForXSS() method, and the script executes in the browsers of other staff members or administrators.
Risk Assessment
Possible session hijacking of other users or actions performed on their behalf when an infected ticket is viewed. Requires an authenticated staff account.
Recommendation
Update GFI HelpDesk to version 4.99.9 or later. Consider additional content filtering and a Content-Security-Policy header.
Other vulnerabilities in GFI HelpDesk
See all- CVE-2026-23757Medium
GFI HelpDesk before 4.99.10 contains a stored XSS vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization. Attackers can inject arbitrary JavaScript into the report title, which executes when staff click the affected report link in Manage Reports.
- CVE-2026-23756Medium
GFI HelpDesk before 4.99.9 contains a stored XSS vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in Controller_Step.InsertSubmit() and EditSubmit() before rendering by View_Step.RenderViewSteps(). An authenticated staff member can inject arbitrary JavaScript into the step subject, which executes when any user clicks the affected step link in Troubleshooter > View Troubleshooter.
- CVE-2026-23753Medium
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality. The charset POST parameter is passed without HTML sanitization to SWIFT_Language::Create() and rendered unsanitized by View_Language.RenderGrid(), allowing an authenticated administrator to inject arbitrary JavaScript.
- CVE-2026-23752Medium
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality. An authenticated administrator can inject arbitrary JavaScript via the companyname POST parameter without HTML sanitization, and the script executes in the browsers of administrators viewing the Templates > Groups page.
Original NVD description (English source)
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject malicious JavaScript by manipulating the editsubject POST parameter. Attackers can inject XSS payloads through inadequate sanitization in Controller_Ticket.EditSubmit() that bypass the incomplete SanitizeForXSS() method to execute arbitrary JavaScript when other staff members or administrators view the affected ticket.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS