CVE-2026-23757

GFI HelpDesk versions prior to 4.99.10 contain a stored cross-site scripting (XSS) vulnerability in the Reports module where user-supplied input in the report title parameter is not properly sanitized before being processed by the SWIFT_Report::Create() function. An authenticated attacker can inject malicious JavaScript code into report titles, and this payload will execute in the browsers of staff members when they view or interact with the affected report in the Manage Reports interface. The vulnerability has a CVSS score of 5.4 (Medium) and requires network access with low complexity, but necessitates user interaction and valid credentials to exploit. The attack vector is network-based, and successful exploitation could result in limited confidentiality and integrity impacts through session hijacking, credential theft, or administrative actions performed in the context of the victim's browser. There is currently no evidence of active exploitation in the wild, no public exploit code availability, and minimal community attention as reflected by the low EPSS score of 0.00029. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence hotlists. Organizations running affected versions should apply patches at their standard maintenance cadence, prioritizing systems with high user interaction in the Reports module.