CVE-2026-23757 — GFI HelpDesk < 4.99.10 Stored XSS via Reports Module
GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() wit…
Published: 2026-04-20 · CVSS: 5.1 · CVSS 4.0
GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization. Attackers can inject arbitrary JavaScript into the report title field when creating or editing a report, and the payload executes when staff members view and click the affected report link in the Manage Reports interface.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7