Gfi Software
Monthly
Argument injection in GFI Exinda AI before 7.6.5 allows any authenticated user - including those with the lowest-privilege Unprivileged account - to exfiltrate arbitrary files from the host system. The web_tools_cmd() function in the Tools Iperf Client feature concatenates user-supplied server and options parameters directly into an iperf command without sanitization, enabling injection of the iperf -F flag to redirect file contents to an attacker-controlled iperf server. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but exploitation is straightforward given knowledge of standard iperf flags.
Arbitrary root-level file deletion in GFI Exinda AI before 7.6.5 is possible through a path traversal flaw in the diagnostic file deletion handler. The `unlink_or_email_file()` function appends user-controlled parameter values (prefixed `v_file_row_`) directly to a base directory path without sanitizing for `../` sequences, allowing any file on the filesystem to be targeted. Exploitation requires authenticated Admin-level access via the network management interface; no public exploit code or CISA KEV listing exists at time of analysis.
Path traversal in GFI Exinda AI before 7.6.5 allows an authenticated administrator to read arbitrary files from the underlying system as root. The vulnerability resides in the wcf_handle_download() function within the system maintenance configuration download handler, which fails to sanitize directory traversal sequences embedded in parameters prefixed with v_del_ before appending them to the base configuration directory path. No public exploit code or active exploitation has been identified at the time of analysis, and exploitation is constrained to Admin-privileged accounts.
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated users to inject arbitrary web script via the scheduled report name field in the MailInsights module. The injected payload is persisted by the server-side handler ReportScheduling.btnSaveReport_Click() without output encoding and fires only in the browser of the user who created the report, making this effectively a self-XSS - significantly constraining real-world impact unless the stored report name is also rendered in other authenticated users' sessions. No public exploit code or active exploitation confirmed by CISA KEV has been identified at time of analysis.
Stored cross-site scripting in GFI Archiver before version 15.13 enables authenticated attackers to persist arbitrary JavaScript in the Archive Assistant default import settings by injecting through the configured folders parameter at /Archiver/ImportSettingsWizard.ashx. The payload survives server-side because SaveAllConfigSettings() writes it to storage without output encoding, then executes in the browser of any subsequent user who views the import settings page - including potentially higher-privileged administrators. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects the authenticated entry requirement and the downstream scope change to other users' browser sessions.
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated network-accessible users to inject persistent JavaScript into the File Archive Assistant configuration page via the excluded extensions parameter. The payload is stored server-side by `FileArchiveAssistantWizard.btnSave_Click()` without output encoding and executes in the browser of any user who subsequently views the File Archive Assistant settings page - typically an administrator. No public exploit identified at time of analysis and no CISA KEV listing; real-world impact is limited to browser-session-level attacks against users who access the specific settings page.
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privileged users to inject persistent JavaScript into the SMTP server address field of the General Settings wizard, which subsequently executes in the browsers of any user who views that settings page. The flaw resides in the server-side method GeneralSettingsWizard.SaveAllConfigSettings(), which persists the SMTP address parameter without output encoding, enabling payload storage and deferred execution. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low attack complexity and the likelihood that administrators frequently access General Settings elevates practical risk beyond the moderate CVSS 4.0 score of 5.1.
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated attackers to inject persistent malicious scripts via the proxy server address field in the Call Home configuration wizard. The `CallHomeSettingsWizard.SaveAllConfigSettings()` method stores the attacker-supplied input without output encoding, and the payload subsequently executes in the browsers of any user who visits the General Settings Additional Settings page - including administrators, whose sessions could be harvested. No public exploit or CISA KEV listing is identified at time of analysis, but the stored nature of the XSS elevates impact beyond a reflected variant by enabling broad victim targeting post-injection.
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to persistently inject arbitrary JavaScript or HTML via the server URL parameter on the IMAP Server configuration wizard at /Archiver/ImapServerWizard.aspx. The payload is written to persistent storage by ImapServerWizard.SaveAllConfigSettings() without output encoding, and executes in the browser of any user - typically an administrator - who subsequently navigates to the IMAP Server configuration page. No public exploit identified at time of analysis and this vulnerability is not listed in CISA KEV.
Stored cross-site scripting in GFI Archiver's web administration interface allows low-privileged authenticated users to inject persistent JavaScript payloads via the policy name field of the File History Retention Policy wizard. The injected payload is written to storage by `RetentionPolicyWizard.SaveAllConfigSettings()` without output encoding and subsequently executes in the browser of any user — including higher-privileged administrators — who views the File History Retention Policies page. No public exploit or active exploitation has been identified; the CVSS 4.0 score of 5.1 reflects the passive user-interaction dependency that limits immediate attacker control.
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privilege users to inject arbitrary script via the Retention Policy name field at /Archiver/RetentionPolicyWizard.aspx, with the payload persisting through SaveAllConfigSettings() and executing against any user who subsequently views the Retention and Spam Policies page. The CVSS 4.0 score of 5.1 reflects network-accessible reach offset by required authentication and passive victim interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, suggesting this has not yet seen active widespread exploitation.
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to inject persistent malicious scripts via the Classification Rules configuration, specifically the rule name and email criteria fields in CategorizationPolicyWizard.aspx. The injected payload is written to the backend by SaveAllConfigSettings() without any output encoding, causing it to execute in the browsers of every subsequent user who views the Classification Rules page - including administrators. No public exploit code has been identified and no active exploitation is confirmed at time of analysis.
GFI HelpDesk before version 4.99.9 contains a stored cross-site scripting vulnerability in language management where the charset POST parameter is not HTML-sanitized before being rendered by the View_Language.RenderGrid() function. An authenticated administrator can inject arbitrary JavaScript through the charset field when creating or editing a language, with the payload executing in the browsers of other administrators viewing the Languages page. This is a medium-risk vulnerability limited to authenticated administrators but affecting any admin viewer.
GFI HelpDesk before version 4.99.9 allows authenticated administrators to inject stored cross-site scripting (XSS) payloads via the companyname parameter in template group creation and editing, with malicious scripts executing in the browsers of other administrators viewing the Templates > Groups page. The attack requires administrative credentials and user interaction (victim viewing the affected page), but succeeds against all administrator accounts with access to that interface.
Stored cross-site scripting in GFI HelpDesk before version 4.99.9 allows authenticated staff members to inject arbitrary JavaScript via the Troubleshooter step subject field, with execution occurring when any user views the affected step. The vulnerability stems from unsanitized POST parameter handling in Controller_Step.InsertSubmit() and EditSubmit() methods, enabling persistent payload storage and broad user impact within the application.
GFI HelpDesk before version 4.99.9 allows authenticated staff members to inject persistent JavaScript into ticket subject fields via inadequate sanitization in the editsubject POST parameter, enabling arbitrary script execution when other staff or administrators view affected tickets. The vulnerability impacts confidentiality and integrity within the application's scope, with exploitation confirmed possible but requiring valid staff credentials and user interaction (viewing the malicious ticket). Patch version 4.99.9 or later is available from the vendor.
Stored cross-site scripting in GFI HelpDesk before version 4.99.10 allows authenticated attackers to inject arbitrary JavaScript into report titles via the Reports module, with payload execution triggered when staff members access the report link in the Manage Reports interface. The vulnerability requires attacker authentication and user interaction (clicking the report link), limiting real-world impact to internal staff compromise scenarios rather than mass exploitation. Patch is available from the vendor.
Argument injection in GFI Exinda AI before 7.6.5 allows any authenticated user - including those with the lowest-privilege Unprivileged account - to exfiltrate arbitrary files from the host system. The web_tools_cmd() function in the Tools Iperf Client feature concatenates user-supplied server and options parameters directly into an iperf command without sanitization, enabling injection of the iperf -F flag to redirect file contents to an attacker-controlled iperf server. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but exploitation is straightforward given knowledge of standard iperf flags.
Arbitrary root-level file deletion in GFI Exinda AI before 7.6.5 is possible through a path traversal flaw in the diagnostic file deletion handler. The `unlink_or_email_file()` function appends user-controlled parameter values (prefixed `v_file_row_`) directly to a base directory path without sanitizing for `../` sequences, allowing any file on the filesystem to be targeted. Exploitation requires authenticated Admin-level access via the network management interface; no public exploit code or CISA KEV listing exists at time of analysis.
Path traversal in GFI Exinda AI before 7.6.5 allows an authenticated administrator to read arbitrary files from the underlying system as root. The vulnerability resides in the wcf_handle_download() function within the system maintenance configuration download handler, which fails to sanitize directory traversal sequences embedded in parameters prefixed with v_del_ before appending them to the base configuration directory path. No public exploit code or active exploitation has been identified at the time of analysis, and exploitation is constrained to Admin-privileged accounts.
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated users to inject arbitrary web script via the scheduled report name field in the MailInsights module. The injected payload is persisted by the server-side handler ReportScheduling.btnSaveReport_Click() without output encoding and fires only in the browser of the user who created the report, making this effectively a self-XSS - significantly constraining real-world impact unless the stored report name is also rendered in other authenticated users' sessions. No public exploit code or active exploitation confirmed by CISA KEV has been identified at time of analysis.
Stored cross-site scripting in GFI Archiver before version 15.13 enables authenticated attackers to persist arbitrary JavaScript in the Archive Assistant default import settings by injecting through the configured folders parameter at /Archiver/ImportSettingsWizard.ashx. The payload survives server-side because SaveAllConfigSettings() writes it to storage without output encoding, then executes in the browser of any subsequent user who views the import settings page - including potentially higher-privileged administrators. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects the authenticated entry requirement and the downstream scope change to other users' browser sessions.
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated network-accessible users to inject persistent JavaScript into the File Archive Assistant configuration page via the excluded extensions parameter. The payload is stored server-side by `FileArchiveAssistantWizard.btnSave_Click()` without output encoding and executes in the browser of any user who subsequently views the File Archive Assistant settings page - typically an administrator. No public exploit identified at time of analysis and no CISA KEV listing; real-world impact is limited to browser-session-level attacks against users who access the specific settings page.
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privileged users to inject persistent JavaScript into the SMTP server address field of the General Settings wizard, which subsequently executes in the browsers of any user who views that settings page. The flaw resides in the server-side method GeneralSettingsWizard.SaveAllConfigSettings(), which persists the SMTP address parameter without output encoding, enabling payload storage and deferred execution. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low attack complexity and the likelihood that administrators frequently access General Settings elevates practical risk beyond the moderate CVSS 4.0 score of 5.1.
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated attackers to inject persistent malicious scripts via the proxy server address field in the Call Home configuration wizard. The `CallHomeSettingsWizard.SaveAllConfigSettings()` method stores the attacker-supplied input without output encoding, and the payload subsequently executes in the browsers of any user who visits the General Settings Additional Settings page - including administrators, whose sessions could be harvested. No public exploit or CISA KEV listing is identified at time of analysis, but the stored nature of the XSS elevates impact beyond a reflected variant by enabling broad victim targeting post-injection.
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to persistently inject arbitrary JavaScript or HTML via the server URL parameter on the IMAP Server configuration wizard at /Archiver/ImapServerWizard.aspx. The payload is written to persistent storage by ImapServerWizard.SaveAllConfigSettings() without output encoding, and executes in the browser of any user - typically an administrator - who subsequently navigates to the IMAP Server configuration page. No public exploit identified at time of analysis and this vulnerability is not listed in CISA KEV.
Stored cross-site scripting in GFI Archiver's web administration interface allows low-privileged authenticated users to inject persistent JavaScript payloads via the policy name field of the File History Retention Policy wizard. The injected payload is written to storage by `RetentionPolicyWizard.SaveAllConfigSettings()` without output encoding and subsequently executes in the browser of any user — including higher-privileged administrators — who views the File History Retention Policies page. No public exploit or active exploitation has been identified; the CVSS 4.0 score of 5.1 reflects the passive user-interaction dependency that limits immediate attacker control.
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privilege users to inject arbitrary script via the Retention Policy name field at /Archiver/RetentionPolicyWizard.aspx, with the payload persisting through SaveAllConfigSettings() and executing against any user who subsequently views the Retention and Spam Policies page. The CVSS 4.0 score of 5.1 reflects network-accessible reach offset by required authentication and passive victim interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, suggesting this has not yet seen active widespread exploitation.
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to inject persistent malicious scripts via the Classification Rules configuration, specifically the rule name and email criteria fields in CategorizationPolicyWizard.aspx. The injected payload is written to the backend by SaveAllConfigSettings() without any output encoding, causing it to execute in the browsers of every subsequent user who views the Classification Rules page - including administrators. No public exploit code has been identified and no active exploitation is confirmed at time of analysis.
GFI HelpDesk before version 4.99.9 contains a stored cross-site scripting vulnerability in language management where the charset POST parameter is not HTML-sanitized before being rendered by the View_Language.RenderGrid() function. An authenticated administrator can inject arbitrary JavaScript through the charset field when creating or editing a language, with the payload executing in the browsers of other administrators viewing the Languages page. This is a medium-risk vulnerability limited to authenticated administrators but affecting any admin viewer.
GFI HelpDesk before version 4.99.9 allows authenticated administrators to inject stored cross-site scripting (XSS) payloads via the companyname parameter in template group creation and editing, with malicious scripts executing in the browsers of other administrators viewing the Templates > Groups page. The attack requires administrative credentials and user interaction (victim viewing the affected page), but succeeds against all administrator accounts with access to that interface.
Stored cross-site scripting in GFI HelpDesk before version 4.99.9 allows authenticated staff members to inject arbitrary JavaScript via the Troubleshooter step subject field, with execution occurring when any user views the affected step. The vulnerability stems from unsanitized POST parameter handling in Controller_Step.InsertSubmit() and EditSubmit() methods, enabling persistent payload storage and broad user impact within the application.
GFI HelpDesk before version 4.99.9 allows authenticated staff members to inject persistent JavaScript into ticket subject fields via inadequate sanitization in the editsubject POST parameter, enabling arbitrary script execution when other staff or administrators view affected tickets. The vulnerability impacts confidentiality and integrity within the application's scope, with exploitation confirmed possible but requiring valid staff credentials and user interaction (viewing the malicious ticket). Patch version 4.99.9 or later is available from the vendor.
Stored cross-site scripting in GFI HelpDesk before version 4.99.10 allows authenticated attackers to inject arbitrary JavaScript into report titles via the Reports module, with payload execution triggered when staff members access the report link in the Manage Reports interface. The vulnerability requires attacker authentication and user interaction (clicking the report link), limiting real-world impact to internal staff compromise scenarios rather than mass exploitation. Patch is available from the vendor.