CVE-2026-23757 is a stored cross-site scripting vulnerability in GFI Software HelpDesk prior to version 4.99.10. The issue occurs in the Reports module where the title parameter is not sanitized before being passed to SWIFT_Report::Create(), enabling injection of arbitrary JavaScript code. This malicious script executes when staff members view or click the affected report link in the Manage Reports interface, potentially leading to unauthorized script execution in the context of the user's session.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a staff member's session when they view or click a maliciously crafted report title. This could lead to session hijacking, unauthorized actions, or other client-side impacts typical of stored XSS vulnerabilities. However, there is no indication of privilege escalation or direct system compromise from the provided data.

No official patch or remediation has been confirmed at this time. Users should monitor the vendor's advisory for updates regarding a fix. Until a patch is available, consider restricting report creation and editing privileges to trusted users only and avoid clicking on untrusted report links. Implementing additional input validation or output encoding at the application layer may help mitigate risk temporarily.