CVE-2023-0357

CVE-2023-0357 concerns Helpy 2.8.0, where an unauthenticated remote attacker can exploit a stored XSS vulnerability by abusing how attachments to tickets are validated. The issue is caused by improper validation of customer attachments, enabling injection of script content that persists in the ap...

CVE-2018-18886

Helpy v2.1.0 is affected by a Stored XSS vulnerability in the Ticket title field. The issue is documented across multiple sources (CVE-2018-18886) and, per CNVD, stems from insufficient validation of client-side data, enabling an attacker to execute client-side code. This is a user-input based XS...

CVE-2018-20851

Helpy before 2.2.0 is affected by CVE-2018-20851, with the vulnerability described as: agents can edit admins. The connected sources corroborate the product and vulnerable state, and the CVSS scores indicate high impact (8.8 in CVSS v3.0). The underlying root cause and a remediation are not detai...

CVE-2025-52184

A Cross-Site Scripting (XSS) vulnerability exists in Helpy.io version 2.8.0 , a self-hosted customer service platform. The flaw is located within the New Topic Ticket function and allows a remote attacker to escalate privileges . To mitigate this risk, users are recommended to update to a newer v...

CVE-2026-40229

Helpy (version 2.8.0) has a Stored Cross-Site Scripting (XSS) in the post author display logic (PostsHelper). An authenticated user can persist arbitrary HTML in their account name, which is rendered unescaped in public forum threads, the admin ticket view, and HTML notification emails sent to ot...

CVE-2026-40230

CVE-2026-40230 (Helpy 2.8.0) : A stored cross-site scripting vulnerability exists in the knowledge base Doc rendering logic. An authenticated attacker with admin or agent editor privileges can persist arbitrary HTML or JavaScript in the body field of a knowledge base Doc. This is tied to Helpy ve...