GFI HelpDesk versions prior to 4.99.9 contain a stored XSS flaw in the language management module; the charset POST parameter is passed untrusted to SWIFT_Language::Create() and later rendered unsanitized by View_Language.RenderGrid(). An attacker who can log in as an administrator can insert arbitrary JavaScript into the charset field of any language entry. When another administrator opens the Languages page, the injected script runs in that admin's browser, allowing the attacker to capture session cookies, forge requests, or perform actions on behalf of the administrator without further exploitation.

The affected systems are installations of GFI Software HelpDesk with a version less than 4.99.9. No other products or specific version ranges are listed in the CNA data.

The attack requires authenticated administrator access, so it is not a public‑facing flaw but it can be leveraged by an insider or a compromised admin account. The CVSS score of 4.8 places it in the medium severity range; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. An attacker who has gained admin credentials can exploit the stored XSS during routine use of the Languages page, potentially leading to privilege escalation, credential theft, or unauthorized actions within the HelpDesk application.