---
id: CVE-2026-23758
title: GFI HelpDesk < 4.99.9 Stored XSS via editsubject Parameter
summary: "GFI HelpDesk before\_4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject malicious JavaScript by manipulating the editsubject POST parameter. Attackers …"
severity: medium
cvss: 5.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: GFI Software
product: HelpDesk
affected:
  - HelpDesk < 4.99.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-04-20T17:45:49.058406Z'
published: '2026-04-20'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T15:19:52.281Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23758'
references:
  - url: >-
      https://gfi.ai/products-and-solutions/email-and-messaging-solutions/helpdesk/resources/product-releases
  - url: >-
      https://www.vulncheck.com/advisories/gfi-helpdesk-stored-xss-via-editsubject-parameter
tags:
  - cve.org
epss: 0.00153
epssPercentile: 0.03772
ingestedAt: '2026-10-01T15:48:17.868Z'
---

## Overview

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject malicious JavaScript by manipulating the editsubject POST parameter. Attackers can inject XSS payloads through inadequate sanitization in Controller_Ticket.EditSubmit() that bypass the incomplete SanitizeForXSS() method to execute arbitrary JavaScript when other staff members or administrators view the affected ticket.

## Affected

- `HelpDesk < 4.99.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.