Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Advisory: GFI Software HelpDesk — gfi.ai/products-and-solutions/email-and-messaging-solutions… Clear all filters
TI-2026-19126 CVE-2026-23753 · GHSA-xj4v-3q69-qpxx

GFI HelpDesk < 4.99.9 Stored XSS via charset Parameter

Priority LOW 21

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality where the charset POST parameter is passed directly to SWIFT_Language::Create() without HTML saniti…

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00151 Published 2026-04-20 Fixed in 4.99.9 CWE-79
TI-2026-19125 CVE-2026-23752 · GHSA-6cc4-jwpj-2vp9

GFI HelpDesk < 4.99.9 Stored XSS via companyname Parameter

Priority LOW 21

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authenticated administrators to inject arbitrary JavaScript by manipula…

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00151 Published 2026-04-20 Fixed in 4.99.9 CWE-79
TI-2026-19129 CVE-2026-23756 · GHSA-99wh-5v8j-65hf

GFI HelpDesk < 4.99.9 Stored XSS via Troubleshooter Step Subject

Priority LOW 22

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in Controller_Step.InsertSubmit() and EditSubmit() before bei…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00141 Published 2026-04-20 Fixed in 4.99.9 CWE-79
TI-2026-19131 CVE-2026-23758 · GHSA-rf6c-2qc7-c945

GFI HelpDesk < 4.99.9 Stored XSS via editsubject Parameter

Priority LOW 27

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject malicious JavaScript by manipulating the editsubject POST para…

CVSS 4.0MEDIUM 6.4 Network Low privileges User interaction EPSS 0.00153 Published 2026-04-20 Fixed in 4.99.9 CWE-79
TI-2026-19130 CVE-2026-23757 · GHSA-27jw-fcpv-p46x

GFI HelpDesk < 4.99.10 Stored XSS via Reports Module

Priority LOW 22

GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00141 Published 2026-04-20 Fixed in 4.99.10 CWE-79