Stored Cross-Site Scripting in GFI HelpDesk by GFI Software

CVE-2026-23757

What is CVE-2026-23757?

GFI HelpDesk prior to version 4.99.10 is susceptible to a stored cross-site scripting (XSS) vulnerability in the Reports module. This flaw arises from improper handling of the title parameter during report creation or editing. Without adequate HTML sanitization, attackers can exploit this vulnerability by injecting malicious JavaScript into the report title. When an unsuspecting staff member views or clicks on the compromised report link within the Manage Reports interface, the injected script executes, potentially compromising sensitive information or creating backdoor access.

References