CVE-2026-23752: GFI HelpDesk < 4.99.9 Stored XSS via companyname Parameter
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authenticated administrators to inject arbitrary JavaScript by manipulating the companyname POST parameter without HTML sanitization. Attackers can inject malicious scripts through the companyname field that execute in the browsers of any administrator viewing the Templates > Groups page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23752?
CVE-2026-23752 is a stored cross-site scripting vulnerability that can lead to significant security risks for affected users.
How do I fix CVE-2026-23752?
To mitigate CVE-2026-23752, upgrade GFI HelpDesk to version 4.99.9 or later.
Who is affected by CVE-2026-23752?
Authenticated administrators using GFI HelpDesk versions prior to 4.99.9 are affected by CVE-2026-23752.
What kind of attack can CVE-2026-23752 facilitate?
CVE-2026-23752 can facilitate JavaScript injection attacks through the companyname parameter in the template group creation and editing functionality.
Is there a workaround for CVE-2026-23752 before the patch is applied?
There is no official workaround for CVE-2026-23752; upgrading to the latest version is the recommended course of action.