CVE-2026-23758

GFI HelpDesk prior to 4.99.9 is affected by a stored XSS in the ticket subject via the editsubject POST parameter. The issue arises from insufficient sanitization in Controller_Ticket.EditSubmit(), which bypasses the incomplete SanitizeForXSS() method, permitting an authenticated staff member to ...