This vulnerability involves improper neutralization of input during web page generation (CWE-79) in GFI HelpDesk's Troubleshooter module. Specifically, the subject parameter submitted via POST in Controller_Step.InsertSubmit() and EditSubmit() is not sanitized before being rendered by View_Step.RenderViewSteps(). This allows an authenticated staff user to store malicious JavaScript code in the step subject field. When any user navigates to Troubleshooter > View Troubleshooter and clicks the affected step link, the injected script executes, leading to a stored XSS condition.

An authenticated staff member can inject and store malicious JavaScript code that executes in the context of other users who view the affected Troubleshooter step. This could lead to session hijacking, unauthorized actions, or other client-side attacks against users of the HelpDesk application. However, exploitation requires authentication and user interaction, limiting the scope of impact. The CVSS 4.0 base score is 5.1, indicating a medium severity level.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, organizations should restrict staff permissions to trusted users only and consider monitoring or limiting access to the Troubleshooter module to reduce risk. Applying input validation or output encoding on the subject parameter in custom deployments may mitigate the issue.