EUVD-2026-23908Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in Controller_Step.InsertSubmit() and EditSubmit() before being rendered by View_Step.RenderViewSteps(). An authenticated staff member can inject arbitrary JavaScript into the step subject field, and the payload executes when any user navigates to Troubleshooter > View Troubleshooter and clicks the affected step link.
AnalysisAI
Stored cross-site scripting in GFI HelpDesk before version 4.99.9 allows authenticated staff members to inject arbitrary JavaScript via the Troubleshooter step subject field, with execution occurring when any user views the affected step. The vulnerability stems from unsanitized POST parameter handling in Controller_Step.InsertSubmit() and EditSubmit() methods, enabling persistent payload storage and broad user impact within the application.
Technical ContextAI
GFI HelpDesk's Troubleshooter module contains a stored XSS vulnerability (CWE-79) in the step creation and editing workflow. The subject parameter received via POST requests in Controller_Step.InsertSubmit() and EditSubmit() methods lacks input sanitization before being persisted to the backend store. When View_Step.RenderViewSteps() renders the Troubleshooter interface, the unsanitized subject content is inserted into the HTML DOM without encoding, allowing injected JavaScript to execute in the browser context of any user accessing the Troubleshooter > View Troubleshooter section. This is a classic stored XSS pattern where malicious input is saved server-side and re-rendered to multiple users without sanitization, amplifying the attack surface.
RemediationAI
Upgrade GFI HelpDesk to version 4.99.9 or later immediately. The vendor has released a patched version addressing the unsanitized subject parameter handling in the Troubleshooter module. Consult the official GFI product releases page (https://gfi.ai/products-and-solutions/email-and-messaging-solutions/helpdesk/resources/product-releases) for download and deployment instructions. If immediate patching is not feasible, implement input validation and output encoding controls: (1) Restrict access to Troubleshooter step creation/editing to a minimal set of trusted staff via role-based access controls, reducing the attacker surface to only high-privilege accounts; note this does not eliminate the vulnerability but reduces exposure. (2) Implement a Content Security Policy (CSP) header with script-src 'self' on all Troubleshooter pages to block inline script execution, though encoded payloads or DOM-based vectors may bypass depending on CSP strictness. (3) Monitor authentication logs for suspicious staff account activity, particularly rapid step creation by accounts with no prior Troubleshooter history. These mitigations do not fix the root cause and should be considered temporary; patching remains the primary remediation.
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 buil
Unauthenticated actors can post ticket replies in Faveo Helpdesk versions 2.0.0 through 2.0.3 by sending crafted request
The documentation component in i-net Clear Reports 16.0 to 19.2, HelpDesk 8.0 to 8.3, and PDFC 4.3 to 6.2 allows a remot
An improper access control vulnerability has been reported to affect QNAP NAS. Rated high severity (CVSS 8.8), this vuln
Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie d
An improper certificate validation vulnerability has been reported to affect Helpdesk. Rated high severity (CVSS 7.7), t
This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Rated med
GFI HelpDesk before version 4.99.9 allows authenticated staff members to inject persistent JavaScript into ticket subjec
Path traversal in Faveo Helpdesk versions 2.0.0 through 2.0.3 enables remote authenticated administrators to delete arbi
Stored cross-site scripting in GFI HelpDesk before version 4.99.10 allows authenticated attackers to inject arbitrary Ja
GFI HelpDesk before version 4.99.9 contains a stored cross-site scripting vulnerability in language management where the
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today