A stored cross‑site scripting vulnerability exists in the Reports module of GFI Software HelpDesk where the title field is accepted without sanitization and passed directly to the SWIFT_Report::Create() function. An attacker can embed arbitrary JavaScript in the title when creating or editing a report; the payload executes in the victim’s browser when a staff member views or clicks the report link in the Manage Reports interface. This client‑side injection can be used for phishing, credential theft, or session hijacking within the HelpDesk application.

The vulnerability affects GFI Software HelpDesk releases prior to version 4.99.10. No other products or versions are listed as impacted.

The CVSS score of 5.1 indicates moderate severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, implying that widespread exploitation has not been documented. The exploit requires a user with the ability to create or edit reports, so the attack is likely confined to internal staff or users who have already compromised staff accounts. Once accessed, the attacker can execute arbitrary JavaScript in the victim’s browser, compromising user data and potentially gaining further foothold inside the organization.