PT-2026-61607 · Maalfer · Pentestify

Marcos García + 1 · CVE-2026-59238 · Publicado 2026-07-20 · Atualizado 2026-07-20

Mitre

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's client logo array, which is interpolated into an src attribute without escaping.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-59238

Produtos afetados

Pentestify

Referências · 3

• https://github.com/maalfer/pentestify/commit/a058a22b42c6311895622645265df79a60265b1d · Correção
• https://secur0.com/en/cna/cve-list/cve-2026-59238-stored-xss-in-pentestify-via-unsanitized-finding-images-and-report-client-logo · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-59238 · Nota de Segurança