The vulnerability resides in GFI HelpDesk versions prior to 4.99.9, where the editsubject POST parameter is processed by Controller_Ticket.EditSubmit() with insufficient sanitization. This flaw permits authenticated staff members to embed JavaScript into the ticket subject field, which is later rendered when other staff or administrators view the ticket, enabling arbitrary script execution. The primary impact is client‑side code execution, potentially leading to credential theft, defacement, or further lateral movement within the intranet, depending on the attacker’s access level.

Affected systems include all installations of GFI Software HelpDesk with a release earlier than 4.99.9. No specific build numbers beyond the major version are listed, so any deployment with a lower release should be scrutinized.

The CVSS score of 6.4 indicates medium severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploitation reports yet. The likely attack path requires user authentication and permission to edit tickets, meaning the threat is confined to staff accounts. However, once the malicious payload is embedded, any staff member viewing the ticket will trigger execution of the injected JavaScript.