GFI HelpDesk versions prior to 4.99.9 have a stored XSS flaw within the Troubleshooter module. The subject parameter is accepted, stored, and rendered without sanitization. An attacker who can authenticate as a staff member can inject JavaScript into the subject; the code runs in the browser of any user who later views the step, enabling malicious scripts to execute on legitimate user sessions.

The vulnerability affects the GFI Software HelpDesk product, specifically versions before 4.99.9.

The CVSS score of 5.1 indicates moderate severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. An authenticated staff member can exploit the flaw, and any user who views the affected step in the Troubleshooter interface becomes a victim of the injected script. The attack requires legitimate staff credentials but offers widespread impact on any user accessing the module.