Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-59238

Stored XSS in Pentestify via unsanitized finding images and report client logo

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Secur0

Description

Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's client_logo array, which is interpolated into an <img> src attribute without escaping.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

maalfer Pentestify

Default version status: unaffected

  • 0 to < 1.1.0affected

References