Description
Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when rendering the report.
Published: 2026-08-11
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability permits authenticated users to embed arbitrary JavaScript into the application origin. By inserting malicious markup into a finding's severity field, the front‑end renders the content inside class and style attributes without escaping it, thereby executing attacker‑controlled scripts when the report is viewed.

Affected Systems

The flaw appears in Pentestify from maalfer. All releases prior to version 2.3.1 store the severity field without sanitization, leaving any such installation vulnerable.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate impact. EPSS information is not available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires an authenticated session with the ability to create or edit findings; the attacker crafts a payload in the severity field and triggers the report rendering to run JavaScript in the victim’s browser. The effect is confined to the client context and can lead to session hijacking or data theft within the application.

Generated by OpenCVE AI on August 11, 2026 at 23:27 UTC.

Remediation

Vendor Solution

Upgrade to version 2.3.1 or higher.

OpenCVE Recommended Actions

  • Upgrade Pentestify to version 2.3.1 or later, where the severity field is sanitized before rendering.
  • For installations that cannot upgrade immediately, sanitize input on the server side so that any HTML in the severity field is escaped or stripped before storage and rendering.
  • Restrict editing of findings to users who can verify that the severity field contains only plain text, and consider adding a content‑security‑policy that disallows inline scripts in the application.

Generated by OpenCVE AI on August 11, 2026 at 23:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 12 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
Description Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when rendering the report.
Title Stored Cross-site Scripting in Pentestify finding severity field
First Time appeared Maalfer
Maalfer pentestify
Weaknesses CWE-79
CPEs cpe:2.3:a:maalfer:pentestify:*:*:*:*:*:*:*:*
Vendors & Products Maalfer
Maalfer pentestify
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Maalfer Pentestify
cve-icon MITRE

Status: PUBLISHED

Assigner: Secur0

Published:

Updated: 2026-08-12T18:34:56.305Z

Reserved: 2026-08-10T12:41:24.644Z

Link: CVE-2026-19434

cve-icon Vulnrichment

Updated: 2026-08-12T18:34:37.812Z

cve-icon NVD

Status : Received

Published: 2026-08-11T14:17:13.433

Modified: 2026-08-12T19:17:32.067

Link: CVE-2026-19434

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-12T00:15:12Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')