CVE-2026-23757: GFI HelpDesk < 4.99.10 Stored XSS via Reports Module
GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFTReport::Create() without HTML sanitization. Attackers can inject arbitrary JavaScript into the report title field when creating or editing a report, and the payload executes when staff members view and click the affected report link in the Manage Reports interface.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23757?
CVE-2026-23757 has been classified as a medium severity vulnerability due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2026-23757?
To fix CVE-2026-23757, upgrade GFI HelpDesk to version 4.99.10 or later.
What types of attacks can exploit CVE-2026-23757?
CVE-2026-23757 can be exploited to conduct stored cross-site scripting attacks, potentially leading to session hijacking or data theft.
Who is affected by CVE-2026-23757?
CVE-2026-23757 affects all versions of GFI HelpDesk prior to 4.99.10.
What component of GFI HelpDesk is vulnerable in CVE-2026-23757?
The vulnerability in CVE-2026-23757 exists in the Reports module where the title parameter lacks proper HTML sanitization.