Pentestify is vulnerable to stored cross‑site scripting (CWE‑79). Unsanitized image URLs stored in a finding’s images array or a report’s client_logo array are inserted directly into an `<img>` element’s `src` attribute without proper escaping. This allows a remote authenticated attacker to execute arbitrary JavaScript in the browser of any user who opens an affected report, giving the attacker the ability to execute arbitrary client‑side scripts, potentially hijacking user sessions, accessing sensitive data, or defacing the web interface.

All users of the maalfer Pentestify platform with versions earlier than 1.1.0 are affected. The vulnerability exists in the client‑side rendering functions (renderPreview, renderEditor, renderAuditData) of js/app.js. Users of Pentestify 1.1.0 and later are not impacted.

The CVSS score of 6.9 indicates moderate severity. The vulnerability can be exploited without requiring server‑side code execution; it relies on client‑side execution when a victim views a report containing a malicious image URL or client_logo entry. An authenticated attacker can create such a malicious entry and then entice or wait for another user to view the report, at which point injected JavaScript runs in the victim’s browser. The EPSS score of 0.00332 (<1%) and the fact that it is not listed in the CISA KEV catalog suggest that exploitation risk is low, but the issue still permits arbitrary client‑side code execution and could be leveraged for phishing or other attacks.