Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality where the charset POST parameter is passed directly to SWIFT_Language::Create() without HTML sanitization and subsequently rendered unsanitized by View_Language.RenderGrid(). An authenticated administrator can inject arbitrary JavaScript through the charset field when creating or editing a language, and the payload executes in the browser of any administrator viewing the Languages page.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-23753 GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality where the charset POST parameter is passed di… https://www.cve.org/CVERecord?id=CVE-2026-23753
Post summary
The text announces CVE-2026-23753, a stored XSS flaw in GFI HelpDesk prior to version 4.99.9, and gives only basic technical details without referencing PoCs, exploits, or patches.
CVE-2026-23753 Stored Cross-Site Scripting in GFI HelpDesk Before 4.99.9 Language Management https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-23753
Post summary
The post announces a stored XSS vulnerability (CVE‑2026‑23753) affecting GFI HelpDesk versions prior to 4.99.9, offering only the basic vulnerability details without hints of exploits or remediation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gfi | helpdesk | - | - | - |