Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Helpy contains a stored cross-site scripting vulnerability in the knowledge base Doc rendering logic. An authenticated attacker with admin or agent editor privileges can persist arbitrary HTML or JavaScript in the body field of a knowledge base Doc.This issue affects helpy: 2.8.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-40230 Stored Cross-Site Scripting in Helpy 2.8.0 Knowledge Base Doc Rendering https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40230
Post summary
The notice identifies CVE‑2026‑40230 as a stored XSS flaw in Helpy 2.8.0’s knowledge‑base rendering, but offers no PoC, exploit, or mitigation details.
CVE-2026-40230 Helpy contains a stored cross-site scripting vulnerability in the knowledge base Doc rendering logic. An authenticated attacker with admin or agent editor privileges … https://www.cve.org/CVERecord?id=CVE-2026-40230
Post summary
The post announces CVE-2026-40230 as a stored XSS flaw in Helpy’s knowledge base rendering logic, noting potential exploitation by privileged users, but does not provide PoC, exploit code, active attack evidence, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | helpy.io | helpy | 2.8.0 | - | - |