EUVD-2026-23929
GHSA-27jw-fcpv-p46x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization. Attackers can inject arbitrary JavaScript into the report title field when creating or editing a report, and the payload executes when staff members view and click the affected report link in the Manage Reports interface.
AnalysisAI
Stored cross-site scripting in GFI HelpDesk before version 4.99.10 allows authenticated attackers to inject arbitrary JavaScript into report titles via the Reports module, with payload execution triggered when staff members access the report link in the Manage Reports interface. The vulnerability requires attacker authentication and user interaction (clicking the report link), limiting real-world impact to internal staff compromise scenarios rather than mass exploitation. Patch is available from the vendor.
Technical ContextAI
GFI HelpDesk's Reports module uses the SWIFT_Report::Create() function to process report creation and editing. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), where the title parameter lacks HTML sanitization before storage in the database. When report links are rendered in the Manage Reports interface, the unsanitized title is included in HTML context without encoding, allowing stored JavaScript payloads to execute in the browser of any staff member who views that report. The SWIFT framework (a PHP-based reporting engine used by GFI products) does not appear to provide automatic output encoding for report metadata.
RemediationAI
Upgrade GFI HelpDesk to version 4.99.10 or later, which includes HTML sanitization for the report title parameter. Organizations unable to patch immediately should restrict access to the Reports module to a minimal set of trusted administrators by role-based access control settings in HelpDesk administrative interface. Additionally, disable the creation or editing of reports by lower-privilege users if business requirements permit; this reduces the pool of accounts capable of injecting payloads. Monitor the SWIFT_Report table in the GFI HelpDesk database for suspicious characters in the title field (script tags, event handlers like onerror/onclick) as a temporary detection control, though this does not prevent execution of already-stored payloads. Web application firewall (WAF) rules can be configured to flag or block report submissions containing common XSS patterns (e.g., <script>, javascript:, onerror=), though this may require tuning to avoid false positives on legitimate special characters in report titles. Refer to the vendor advisory at https://www.vulncheck.com/advisories/gfi-helpdesk-stored-xss-via-reports-module for detailed patching instructions and version verification.
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 buil
Unauthenticated actors can post ticket replies in Faveo Helpdesk versions 2.0.0 through 2.0.3 by sending crafted request
The documentation component in i-net Clear Reports 16.0 to 19.2, HelpDesk 8.0 to 8.3, and PDFC 4.3 to 6.2 allows a remot
An improper access control vulnerability has been reported to affect QNAP NAS. Rated high severity (CVSS 8.8), this vuln
Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie d
An improper certificate validation vulnerability has been reported to affect Helpdesk. Rated high severity (CVSS 7.7), t
This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Rated med
GFI HelpDesk before version 4.99.9 allows authenticated staff members to inject persistent JavaScript into ticket subjec
Path traversal in Faveo Helpdesk versions 2.0.0 through 2.0.3 enables remote authenticated administrators to delete arbi
Stored cross-site scripting in GFI HelpDesk before version 4.99.9 allows authenticated staff members to inject arbitrary
GFI HelpDesk before version 4.99.9 contains a stored cross-site scripting vulnerability in language management where the
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today