CVE-2026-23756

OVERVIEW GFI HelpDesk versions prior to 4.99.9 contain a stored cross-site scripting (XSS) vulnerability in the Troubleshooter module. The vulnerability exists because the subject POST parameter is not properly sanitized in the Controller_Step.InsertSubmit() and EditSubmit() functions before being rendered by View_Step.RenderViewSteps(). An authenticated staff member can exploit this vulnerability to inject arbitrary JavaScript code into the step subject field. SEVERITY The vulnerability carries a CVSS v3.1 score of 5.4 (Medium) with a network attack vector, low attack complexity, and requires low privilege access with user interaction. While no confidentiality or availability impact is expected, the attack can result in limited information disclosure and integrity compromise. The attack chain requires an authenticated staff member to craft malicious input and a user to navigate to the affected Troubleshooter module and click the malicious step link. The stored nature of the XSS means the payload persists and executes against any user who views the affected step. EXPLOITATION STATUS This vulnerability is not currently listed in the Known Exploited Vulnerabilities (KEV) catalog and is marked as inactive on threat intelligence hot lists. The EPSS score of 0.00029 indicates minimal empirical probability of exploitation, placing it higher than only 0.08% of all CVEs. No evidence of public exploit code availability or active exploitation has been identified in community reporting.