Helpy.io Helpy — known CVE vulnerabilities

Every CVE whose affected-product data names Helpy.io Helpy, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (6)

• CVE-2018-20851 — CVSS 8.8 (high): Helpy before 2.2.0 allows agents to edit admins.
• CVE-2018-18886 — CVSS 6.1 (medium): Helpy v2.1.0 has Stored XSS via the Ticket title.
• CVE-2023-0357 — CVSS 6.1 (medium): Helpy version 2.8.0 allows an unauthenticated remote attacker to exploit an XSS stored in the application. This is possible because the…
• CVE-2025-52184 — CVSS 6.1 (medium): Cross Site Scripting vulnerability in Helpy.io v.2.8.0 allows a remote attacker to escalate privileges via the New Topic Ticket funtion.
• CVE-2026-40229 — CVSS 5.4 (medium): Helpy contains a stored cross-site scripting vulnerability in the post author display logic. Any registered user can persist arbitrary HTML…
• CVE-2026-40230 — CVSS 5.4 (medium): Helpy contains a stored cross-site scripting vulnerability in the knowledge base Doc rendering logic. An authenticated attacker with admin…