CVE-2026-23753

GFI HelpDesk versions prior to 4.99.9 contain a stored cross-site scripting vulnerability in the language management feature where the charset parameter fails to properly sanitize user input before storing and displaying it. An authenticated administrator can inject malicious JavaScript through the charset field when creating or editing languages, with the payload executing in the browsers of other administrators accessing the Languages page. The vulnerability affects network-accessible GFI HelpDesk installations and requires administrator-level privileges to exploit. The vulnerability carries a CVSS score of 4.8 (Medium severity) with a network attack vector and low attack complexity. While the impact is limited to low-level confidentiality and integrity compromises with no availability impact, the requirement for high-level administrative privileges reduces overall risk. Exploitation requires user interaction, as the malicious payload only executes when other administrators view the Languages page. There is currently no evidence of active exploitation, with the vulnerability absent from CISA's Known Exploited Vulnerabilities catalog. The EPSS score of 0.00027 indicates minimal likelihood of exploitation in the wild relative to other CVEs. The vulnerability remains on an inactive hot list status with no publicly available exploit code or significant community attention, suggesting limited current threat activity.