CVE-2026-23756

Katalog CVE

CVSS 5.4 · Medium EPSS 0,14%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada gfi helpdesk. Skor CVSS 3.1 5.4 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in Controller_Step.InsertSubmit() and EditSubmit() before being rendered by View_Step.RenderViewSteps(). An authenticated staff member can inject arbitrary JavaScript into the step subject field, and the payload executes when any user navigates to Troubleshooter > View Troubleshooter and clicks the affected step link.

Rincian

Terbit di NVD

20 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,14% peluang dieksploitasi; lebih tinggi dari 3,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vulncheck.com/advisories/gfi-helpdesk-stored-xss-via-troubleshooter-step-subject advisory pihak ketiga
• https://gfi.ai/products-and-solutions/email-and-messaging-solutions/helpdesk/resources/product-releases release notes