PT-2026-61607 · Maalfer · Pentestify

Marcos García + 1 · CVE-2026-59238 · Published 2026-07-20 · Updated 2026-07-20

Mitre

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's client logo array, which is interpolated into an src attribute without escaping.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-59238

Affected Products

Pentestify

References · 3

• https://github.com/maalfer/pentestify/commit/a058a22b42c6311895622645265df79a60265b1d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-59238 · Security Note
• https://secur0.com/en/cna/cve-list/cve-2026-59238-stored-xss-in-pentestify-via-unsanitized-finding-images-and-report-client-logo · Note