https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-23758.htmlhttps://patchthecve.com/cve/CVE-2026-23758.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 5.4: GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows authenticated staff members to inject malicious JavaScript by manipulating the editsubject POST parameter. Attackers can inject XSS payloads through inadequate sanitization in Conthttps://patchthecve.com/cve/CVE-2026-23757.htmlhttps://patchthecve.com/cve/CVE-2026-23757.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 5.4: GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization. Attackers can inject arbitrary JavaScript into the report title field when creating or editing a rehttps://patchthecve.com/cve/CVE-2026-23756.htmlhttps://patchthecve.com/cve/CVE-2026-23756.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 5.4: GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in Controller_Step.InsertSubmit() and EditSubmit() before being rendered by View_Step.RenderViewSteps(). An authenticated staff member can inhttps://patchthecve.com/cve/CVE-2026-23753.htmlhttps://patchthecve.com/cve/CVE-2026-23753.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 4.8: GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality where the charset POST parameter is passed directly to SWIFT_Language::Create() without HTML sanitization and subsequently rendered unsanitized by View_Language.RenderGrid(). An ahttps://patchthecve.com/cve/CVE-2026-23752.htmlhttps://patchthecve.com/cve/CVE-2026-23752.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 4.8: GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authenticated administrators to inject arbitrary JavaScript by manipulating the companyname POST parameter without HTML sanitization. Attackers can inj