Read the docs

GFI Software

Records64All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical8CVSS 9.0–10.0
CVSS high14CVSS 7.0–8.9

Exploited now

GFI Software records in CISA KEV

No GFI Software vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Mailessentials 22 records HIGH Archiver 8 records MEDIUM Helpdesk 5 records LOW Kerio Connect 5 records HIGH Kerio Control 5 records HIGH Mailsecurity 3 records MEDIUM Gfi Backup 2009 1 record LOW Kerio Connect Client 1 record LOW

Records

5 records in Helpdesk · all components

TI-2026-19131 CVE-2026-23758 · GHSA-rf6c-2qc7-c945

GFI HelpDesk < 4.99.9 Stored XSS via editsubject Parameter

Priority LOW 27

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject malicious JavaScript by manipulating the editsubject POST para…

CVSS 4.0MEDIUM 6.4 Network Low privileges User interaction EPSS 0.00153 Published 2026-04-20 Fixed in 4.99.9 CWE-79
TI-2026-19130 CVE-2026-23757 · GHSA-27jw-fcpv-p46x

GFI HelpDesk < 4.99.10 Stored XSS via Reports Module

Priority LOW 22

GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00141 Published 2026-04-20 Fixed in 4.99.10 CWE-79
TI-2026-19129 CVE-2026-23756 · GHSA-99wh-5v8j-65hf

GFI HelpDesk < 4.99.9 Stored XSS via Troubleshooter Step Subject

Priority LOW 22

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in Controller_Step.InsertSubmit() and EditSubmit() before bei…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00141 Published 2026-04-20 Fixed in 4.99.9 CWE-79
TI-2026-19126 CVE-2026-23753 · GHSA-xj4v-3q69-qpxx

GFI HelpDesk < 4.99.9 Stored XSS via charset Parameter

Priority LOW 21

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality where the charset POST parameter is passed directly to SWIFT_Language::Create() without HTML saniti…

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00151 Published 2026-04-20 Fixed in 4.99.9 CWE-79
TI-2026-19125 CVE-2026-23752 · GHSA-6cc4-jwpj-2vp9

GFI HelpDesk < 4.99.9 Stored XSS via companyname Parameter

Priority LOW 21

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authenticated administrators to inject arbitrary JavaScript by manipula…

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00151 Published 2026-04-20 Fixed in 4.99.9 CWE-79
Open these records in search →