GFI HelpDesk before version 4.99.9 contains a stored XSS vulnerability (CWE-79) in its language management feature. The charset POST parameter is passed directly to the SWIFT_Language::Create() function without HTML sanitization and is later rendered unsanitized by View_Language.RenderGrid(). This allows an authenticated administrator to inject malicious JavaScript code that executes in the context of other administrators' browsers when they access the Languages page.

Successful exploitation allows an authenticated administrator to execute arbitrary JavaScript in the browsers of other administrators who view the Languages page. This could lead to session hijacking, unauthorized actions within the HelpDesk application, or other attacks limited to the administrative context. There is no indication of impact beyond the administrative user scope or of remote unauthenticated exploitation.

No official patch or remediation is currently confirmed for this vulnerability. Administrators should monitor the vendor's advisory for updates. Until a fix is available, restrict administrative access to trusted users only and avoid viewing the Languages page if possible. Follow vendor guidance once published for applying official fixes.