PT-2026-33820 · Gfi · Gfi Helpdesk

Alex Williams + 1 · Published 2026-04-20 · Updated 2026-04-21 · CVE-2026-23752

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GFI HelpDesk versions prior to 4.99.9

Description A stored cross-site scripting issue exists in the template group creation and editing functionality. Authenticated administrators can inject arbitrary JavaScript by manipulating the companyname POST parameter, which lacks proper HTML sanitization. Malicious scripts injected through the companyname field execute in the browsers of any administrator who views the 'Templates > Groups' page.

Recommendations Update to version 4.99.9 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-23752

Affected Products

Gfi Helpdesk

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-23752 · Security Note
• https://vulncheck.com/advisories/gfi-helpdesk-stored-xss-via-companyname-parameter · Note
• https://gfi.ai/products-and-solutions/email-and-messaging-solutions/helpdesk/resources/product-releases · Patch, Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2046336279453761986 · Twitter Post
• https://twitter.com/CVEnew/status/2046571914253185485 · Twitter Post