CVE-2026-19434
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when rendering the report.
Risk Assessment
Risk of user session hijacking, data theft, or unauthorized actions within the application context by authenticated users.
Recommendation
Update Pentestify to version 2.3.1 or later, which includes a fix for the XSS vulnerability. Additionally, properly escape input data in the severity field.
Original NVD description (English source)
Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when rendering the report.