🔐 CVE Alert

CVE-2026-23756

MEDIUM 5.4

GFI HelpDesk < 4.99.9 Stored XSS via Troubleshooter Step Subject

CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in Controller_Step.InsertSubmit() and EditSubmit() before being rendered by View_Step.RenderViewSteps(). An authenticated staff member can inject arbitrary JavaScript into the step subject field, and the payload executes when any user navigates to Troubleshooter > View Troubleshooter and clicks the affected step link.

CWE CWE-79
Vendor gfi software
Product helpdesk
Published Apr 20, 2026
Last Updated Apr 20, 2026
Stay Ahead of the Next One

Get instant alerts for gfi software helpdesk

Be the first to know when new medium vulnerabilities affecting gfi software helpdesk are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Affected Versions

GFI Software / HelpDesk
0 < 4.99.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗
gfi.ai: https://gfi.ai/products-and-solutions/email-and-messaging-solutions/helpdesk/resources/product-releases vulncheck.com: https://www.vulncheck.com/advisories/gfi-helpdesk-stored-xss-via-troubleshooter-step-subject

Credits

Alex Williams from Pellera Technologies VulnCheck