CVE-2026-23758: falha de média gravidade em GFI Software HelpDesk
GFI HelpDesk < 4.99.9 Stored XSS via editsubject Parameter
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.2%
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject malicious JavaScript by manipulating the editsubject POST parameter. Attackers can inject XSS payloads through inadequate sanitization in Controller_Ticket.EditSubmit() that bypass the incomplete SanitizeForXSS() method to execute arbitrary JavaScript when other staff members or administrators view the affected ticket.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
GFI Software · HelpDeskCVEs relacionadas — GFI Software HelpDesk
No mesmo produto, das mais perigosas para as menos.
CVE-2026-23753MEDIUMGFI HelpDesk < 4.99.9 Stored XSS via charset ParameterEPSS 0.2%CVE-2026-23752MEDIUMGFI HelpDesk < 4.99.9 Stored XSS via companyname ParameterEPSS 0.2%CVE-2026-23756MEDIUMGFI HelpDesk < 4.99.9 Stored XSS via Troubleshooter Step SubjectEPSS 0.1%CVE-2026-23757MEDIUMGFI HelpDesk < 4.99.10 Stored XSS via Reports ModuleEPSS 0.1%