Description
Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when rendering the report.
Published: 2026-08-11
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

Upgrade to version 2.3.1 or higher.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
Description Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when rendering the report.
Title Stored Cross-site Scripting in Pentestify finding severity field
First Time appeared Maalfer
Maalfer pentestify
Weaknesses CWE-79
CPEs cpe:2.3:a:maalfer:pentestify:*:*:*:*:*:*:*:*
Vendors & Products Maalfer
Maalfer pentestify
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Maalfer Pentestify
cve-icon MITRE

Status: PUBLISHED

Assigner: Secur0

Published:

Updated: 2026-08-11T13:40:59.572Z

Reserved: 2026-08-10T12:41:24.644Z

Link: CVE-2026-19434

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-11T14:17:13.433

Modified: 2026-08-11T14:17:13.433

Link: CVE-2026-19434

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')