CVE-2026-23757: Gfi Helpdesk

Medium severity, CVSS 5.4. EPSS: 0.1% chance of exploitation in the next 30 days.

GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization. Attackers can inject arbitrary JavaScript into the report title field when creating or editing a report, and the payload executes when staff members view and click the affected report link in the Manage Reports interface.

Affected products

• Gfi Helpdesk: before 4.99.10 (fixed in 4.99.10)

Published 2026-04-20. Last modified 2026-06-17.