Description (CNA)
Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's client_logo array, which is interpolated into an <img> src attribute without escaping.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| maalfer / Pentestify | affected 0 before 1.1.0 |
CWE
CWE-79
References
- https://github.com/maalfer/pentestify/commit/a058a22b42c6311895622645265df79a60265b1d
- https://secur0.com/en/cna/cve-list/cve-2026-59238-stored-xss-in-pentestify-via-unsanitized-finding-images-and-report-client-logo
ADP enrichment
No English description supplied.
No references supplied.