CVE-2026-23757 | BDVDB-2026-327773 Detail

Description#

GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization. Attackers can inject arbitrary JavaScript into the report title field when creating or editing a report, and the payload executes when staff members view and click the affected report link in the Manage Reports interface.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-04-20Record published in the CVE List.
2. Version 22026-10-01Most recent update recorded in the CVE List.