Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-59238

Stored XSS in Pentestify via unsanitized finding images and report client logo

Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's client_logo array, which is interpolated into an <img> src attribute without escaping.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Maalfer
Products
Pentestify
CVE-2026-75872

HTML Injection in MailerUp double opt-in verification email

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the first_name field of the subscription request, which is interpolated unescaped into the double opt-in verification email.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Maalfer
Products
Mailerup
CVE-2026-76203

CSS sanitizer bypass in Pentestify report themes allows forced outbound requests

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Maalfer
Products
Pentestify
CVE-2026-19744

Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization step does not escape quotes

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Maalfer
Products
Pentestify
CVE-2026-19716

Stored Cross-site Scripting in Pentestify user account deletion via unescaped username

Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML() before interpolating it into the onclick attribute of the account deletion button, but the browser HTML-decodes attribute values before the JavaScript engine parses the handler, allowing an encoded single quote (') to break out of the string literal and inject arbitrary JavaScript that executes when the victim clicks the delete button for that account.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Maalfer
Products
Pentestify
CVE-2026-19434

Stored Cross-site Scripting in Pentestify finding severity field

Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when rendering the report.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Maalfer
Products
Pentestify