EUVD-2026-23928
GHSA-xj4v-3q69-qpxx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality where the charset POST parameter is passed directly to SWIFT_Language::Create() without HTML sanitization and subsequently rendered unsanitized by View_Language.RenderGrid(). An authenticated administrator can inject arbitrary JavaScript through the charset field when creating or editing a language, and the payload executes in the browser of any administrator viewing the Languages page.
AnalysisAI
GFI HelpDesk before version 4.99.9 contains a stored cross-site scripting vulnerability in language management where the charset POST parameter is not HTML-sanitized before being rendered by the View_Language.RenderGrid() function. An authenticated administrator can inject arbitrary JavaScript through the charset field when creating or editing a language, with the payload executing in the browsers of other administrators viewing the Languages page. This is a medium-risk vulnerability limited to authenticated administrators but affecting any admin viewer.
Technical ContextAI
The vulnerability exists in GFI HelpDesk's language management functionality, specifically in the SWIFT_Language::Create() method which accepts user input from the charset POST parameter without applying HTML entity encoding or sanitization. The root cause is improper input validation and output encoding (CWE-79: Improper Neutralization of Input During Web Page Generation), a classic stored XSS flaw where untrusted data is stored in the application and later rendered without escaping. The charset parameter is intended for HTML character encoding specification but is processed as unsanitized user input. The vulnerability chain involves the administrative interface accepting language configuration data, storing it without sanitization, and then the View_Language.RenderGrid() rendering function outputting this data directly into the HTML response sent to other administrators, creating a persistent XSS payload that executes in their browser context.
RemediationAI
Upgrade GFI HelpDesk to version 4.99.9 or later, which addresses the vulnerability by implementing proper input sanitization and output encoding in the language management functionality. Organizations unable to immediately patch should implement administrative access controls by restricting the language management permission to only trusted administrators and disabling the language management feature if not actively used. Additionally, regularly audit the Languages configuration page for any suspicious entries in the charset field and review administrative audit logs for unauthorized language creation or modification events. Apply Content Security Policy (CSP) headers with 'script-src self' to provide defense-in-depth against XSS execution, though this does not replace the primary patch fix.
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 buil
Unauthenticated actors can post ticket replies in Faveo Helpdesk versions 2.0.0 through 2.0.3 by sending crafted request
The documentation component in i-net Clear Reports 16.0 to 19.2, HelpDesk 8.0 to 8.3, and PDFC 4.3 to 6.2 allows a remot
An improper access control vulnerability has been reported to affect QNAP NAS. Rated high severity (CVSS 8.8), this vuln
Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie d
An improper certificate validation vulnerability has been reported to affect Helpdesk. Rated high severity (CVSS 7.7), t
This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Rated med
GFI HelpDesk before version 4.99.9 allows authenticated staff members to inject persistent JavaScript into ticket subjec
Path traversal in Faveo Helpdesk versions 2.0.0 through 2.0.3 enables remote authenticated administrators to delete arbi
Stored cross-site scripting in GFI HelpDesk before version 4.99.9 allows authenticated staff members to inject arbitrary
Stored cross-site scripting in GFI HelpDesk before version 4.99.10 allows authenticated attackers to inject arbitrary Ja
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today