The vulnerability in GFI HelpDesk before version 4.99.9 allows an authenticated administrator to inject arbitrary JavaScript via the companyname POST parameter in the template group create and edit pages. The injected script runs in the browsers of any administrator who views the Templates & Groups page, creating a stored cross‑site scripting condition (CWE‑79).

GFI Software HelpDesk prior to version 4.99.9, specifically the template group creation and editing functionality accessed by administrators via the Templates & Groups page.

The CVSS score of 4.8 reflects a moderate risk; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authentication as an administrator, a local attacker with admin credentials can exploit it, or a remote attacker who compromises an admin account, but it cannot be triggered by unauthenticated users. The attack vector is therefore limited to authenticated users with administrative privileges.