What’s Vulnerable › Vulnerabilities

CVE-2026-23758: GFI HelpDesk < 4.99.9 Stored XSS via editsubject Parameter

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-20 · updated 2026-10-26
• Weakness: CWE-79

Description

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject malicious JavaScript by manipulating the editsubject POST parameter. Attackers can inject XSS payloads through inadequate sanitization in Controller_Ticket.EditSubmit() that bypass the incomplete SanitizeForXSS() method to execute arbitrary JavaScript when other staff members or administrators view the affected ticket.

Affected products

• GFI Software HelpDesk: before 4.99.9 — fixed in 4.99.9

How to fix

Upgrade to a fixed version: GFI Software HelpDesk 4.99.9. Check the vendor advisory for mitigations.

References

• https://gfi.ai/products-and-solutions/email-and-messaging-solutions/helpdesk/resources/product-releases
• https://www.vulncheck.com/advisories/gfi-helpdesk-stored-xss-via-editsubject-parameter

Get alerted when CVE-2026-23758 or the next vulnerability affects your stack