Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization. Attackers can inject arbitrary JavaScript into the report title field when creating or editing a report, and the payload executes when staff members view and click the affected report link in the Manage Reports interface.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-23757 GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::C… https://www.cve.org/CVERecord?id=CVE-2026-23757
Post summary
The text is a straightforward disclosure of a stored XSS vulnerability in GFI HelpDesk prior to version 4.99.10, providing technical details but no evidence of exploitation, PoC, or patch information.
CVE-2026-23757 Stored Cross-Site Scripting in GFI HelpDesk Reports Module Before... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-23757 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The post discloses a stored XSS vulnerability in GFI HelpDesk Reports Module, but provides no PoC, exploit details, patch, or active exploitation evidence.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gfi | helpdesk | - | - | - |