Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authenticated administrators to inject arbitrary JavaScript by manipulating the companyname POST parameter without HTML sanitization. Attackers can inject malicious scripts through the companyname field that execute in the browsers of any administrator viewing the Templates > Groups page.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-23752 GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authenticated adm… https://www.cve.org/CVERecord?id=CVE-2026-23752
Post summary
A stored XSS vulnerability in GFI HelpDesk versions before 4.99.9 allows authenticated administrators to inject scripts during template group creation or editing, as outlined in CVE‑2026‑23752.
CVE-2026-23752 Stored Cross-Site Scripting in GFI HelpDesk Before 4.99.9... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-23752 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The text announces a new CVE for stored XSS in GFI HelpDesk, providing basic technical details but no PoC, exploit, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gfi | helpdesk | - | - | - |