CVE-2018-18886

Helpy v2.1.0 is affected by a Stored XSS vulnerability in the Ticket title field. The issue is documented across multiple sources (CVE-2018-18886) and, per CNVD, stems from insufficient validation of client-side data, enabling an attacker to execute client-side code. This is a user-input based XS...

CVE-2023-0357

CVE-2023-0357 concerns Helpy 2.8.0, where an unauthenticated remote attacker can exploit a stored XSS vulnerability by abusing how attachments to tickets are validated. The issue is caused by improper validation of customer attachments, enabling injection of script content that persists in the ap...

CVE-2018-20851

Helpy before 2.2.0 is affected by CVE-2018-20851, with the vulnerability described as: agents can edit admins. The connected sources corroborate the product and vulnerable state, and the CVSS scores indicate high impact (8.8 in CVSS v3.0). The underlying root cause and a remediation are not detai...

CVE-2025-52184

CVE-2025-52184 affects Helpy.io version 2.8.0 and involves a Cross Site Scripting flaw in the New Topic Ticket feature that can allow an attacker to escalate privileges. The CVSS data indicates a Network attack vector, low attack complexity, no privileges required, but user interaction is require...

CVE-2026-40229

Helpy (version 2.8.0) has a Stored Cross-Site Scripting (XSS) in the post author display logic (PostsHelper). An authenticated user can persist arbitrary HTML in their account name, which is rendered unescaped in public forum threads, the admin ticket view, and HTML notification emails sent to ot...

CVE-2026-40230

CVE-2026-40230 (Helpy 2.8.0) : A stored cross-site scripting vulnerability exists in the knowledge base Doc rendering logic. An authenticated attacker with admin or agent editor privileges can persist arbitrary HTML or JavaScript in the body field of a knowledge base Doc. This is tied to Helpy ve...