CVE-2026-19744
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization step does not escape quotes.
Risk Assessment
The risk includes the possibility of executing scripts in the application context, which could lead to data theft, session hijacking, or other unauthorized actions.
Recommendation
It is recommended to upgrade Pentestify to version 2.3.2 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization step does not escape quotes