EUVD-2026-23910
GHSA-rf6c-2qc7-c945
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject malicious JavaScript by manipulating the editsubject POST parameter. Attackers can inject XSS payloads through inadequate sanitization in Controller_Ticket.EditSubmit() that bypass the incomplete SanitizeForXSS() method to execute arbitrary JavaScript when other staff members or administrators view the affected ticket.
AnalysisAI
GFI HelpDesk before version 4.99.9 allows authenticated staff members to inject persistent JavaScript into ticket subject fields via inadequate sanitization in the editsubject POST parameter, enabling arbitrary script execution when other staff or administrators view affected tickets. The vulnerability impacts confidentiality and integrity within the application's scope, with exploitation confirmed possible but requiring valid staff credentials and user interaction (viewing the malicious ticket). Patch version 4.99.9 or later is available from the vendor.
Technical ContextAI
This is a stored cross-site scripting (CWE-79) vulnerability in the GFI HelpDesk ticket management system. The vulnerability exists in the Controller_Ticket.EditSubmit() function, which processes POST requests for the editsubject parameter without properly sanitizing user input before storage in the database. While the application implements a SanitizeForXSS() method, it fails to adequately filter malicious JavaScript payloads, allowing authenticated users to bypass the incomplete sanitization routine. When other staff members or administrators subsequently retrieve and display the affected ticket, the injected JavaScript executes in their browsers with their authentication context, potentially allowing session hijacking, credential theft, or unauthorized actions within the helpdesk system.
RemediationAI
Upgrade GFI HelpDesk to version 4.99.9 or later immediately to obtain the vendor-released patch that corrects the inadequate sanitization in the editsubject parameter handling. The patch is available from GFI's official product release page at https://gfi.ai/products-and-solutions/email-and-messaging-solutions/helpdesk/resources/product-releases. For organizations unable to upgrade immediately, implement the following compensating controls: (1) Restrict the ability to edit ticket subjects to senior administrators only by adjusting role-based access control in GFI HelpDesk settings, though this degrades helpdesk workflow efficiency; (2) Review audit logs for suspicious editsubject modifications and manually inspect tickets edited by staff members with elevated privileges for malicious script tags before opening them in a browser; (3) Implement Content Security Policy (CSP) headers at the web server level to restrict inline script execution, which may interfere with legitimate helpdesk functionality and requires testing before deployment. None of these workarounds fully eliminate the vulnerability - patching is the definitive remediation.
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 buil
Unauthenticated actors can post ticket replies in Faveo Helpdesk versions 2.0.0 through 2.0.3 by sending crafted request
The documentation component in i-net Clear Reports 16.0 to 19.2, HelpDesk 8.0 to 8.3, and PDFC 4.3 to 6.2 allows a remot
An improper access control vulnerability has been reported to affect QNAP NAS. Rated high severity (CVSS 8.8), this vuln
Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie d
An improper certificate validation vulnerability has been reported to affect Helpdesk. Rated high severity (CVSS 7.7), t
This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Rated med
Path traversal in Faveo Helpdesk versions 2.0.0 through 2.0.3 enables remote authenticated administrators to delete arbi
Stored cross-site scripting in GFI HelpDesk before version 4.99.9 allows authenticated staff members to inject arbitrary
Stored cross-site scripting in GFI HelpDesk before version 4.99.10 allows authenticated attackers to inject arbitrary Ja
GFI HelpDesk before version 4.99.9 contains a stored cross-site scripting vulnerability in language management where the
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today