ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-23752

GFI HelpDesk < 4.99.9 Stored XSS via companyname Parameter

CVSS 4.0 4.8 MEDIUMCVSS 3.1 4.8 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-23752

Published

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authenticated administrators to inject arbitrary JavaScript by manipulating the companyname POST parameter without HTML sanitization. Attackers can inject malicious scripts through the companyname field that execute in the browsers of any administrator viewing the Templates > Groups page.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-23752

Published

HelpDesk

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "GFI Software",
                    "product": "HelpDesk",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "4.99.9",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON