Pentestify before version 1.1.1 stores user names in an account‑deletion button with minimal escaping: the frontend runs escapeHTML() before inserting the name into an onclick attribute, but browsers HTML‑decode attribute values before the JavaScript engine parses the handler. An attacker who can create an account with a specially crafted username that contains an encoded single quote can terminate the attribute’s string literal and inject arbitrary JavaScript. When a victim clicks the delete button for that account, the injected code runs in their browser session, allowing the attacker to steal session tokens, deface the page, or perform other client‑side attacks. The flaw is confirmed to exist only when both the attacker and victim are authenticated users of the same instance.

The vulnerability affects Pentestify applications from the vendor maalfer before version 1.1.1. For all supported installations using the affected CPE, users must verify that the software has been upgraded to at least v1.1.1 to receive the remediation. No other vendors or product variants are listed as affected.

The CVSS score of 5.1 indicates moderate severity, and no EPSS score is available; the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authentication and user interaction (the victim must click the delete button), the exploit window is limited to environments where users have administrative or deletion privileges. The attack can be performed remotely via the web interface, but it is contingent on the attacker being able to create an account with a malicious username. Given the moderate CVSS score and the need for user interaction, the likelihood of widespread exploitation is moderate, but it is still advisable to patch promptly where possible.