Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.1

GFI HelpDesk lets staff inject malicious code in troubleshooting steps

CVE-2026-23756 · published 6 months ago
Summary

The HelpDesk product before version 4.99.9 allows a logged‑in staff member to place hidden JavaScript code in the subject of a troubleshooting step. When any user later views the Troubleshooter list and clicks that step, the hidden code runs in their browser, potentially stealing data or altering what they see. Upgrade to version 4.99.9 or later, or apply the vendor’s patch, to stop this behavior.

What to do
  • Update gfi software helpdesk to version 4.99.9 or later.
  • Update gfi helpdesk to version 4.99.9 or later.
Affected software
VendorProductAffected versions
gfi software helpdesk < 4.99.9
gfi helpdesk < 4.99.9
cpe:2.3:a:gfi:helpdesk:*:*:*:*:*:*:*:*
Original advisory text
GFI HelpDesk < 4.99.9 Stored XSS via Troubleshooter Step Subject
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in Controller_Step.InsertSubmit() and EditSubmit() before being rendered by View_Step.RenderViewSteps(). An authenticated staff member can inject arbitrary JavaScript into the step subject field, and the payload executes when any user navigates to Troubleshooter > View Troubleshooter and clicks the affected step link.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published20 Apr 2026
Updated26 Oct 2026
First seen20 Apr 2026
Sources
CVE-2026-23756 · NVD
CVE-2026-23756 · MITRE
Track software like this
Free during beta