CVE-2026-76203mediumCWE-180

CVE-2026-76203: medium-severity vulnerability in maalfer Pentestify

CSS sanitizer bypass in Pentestify report themes allows forced outbound requests

Published · Updated

Follow this CVE+ Monitor Pentestify

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.4%
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
maalfer · Pentestify
Related CVEs — maalfer Pentestify

In the same product, most dangerous first.

CVE-2026-59238MEDIUMStored XSS in Pentestify via unsanitized finding images and report client logoEPSS 0.6%CVE-2026-19744MEDIUMStored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotesEPSS 0.5%CVE-2026-19716MEDIUMStored Cross-site Scripting in Pentestify user account deletion via unescaped usernameEPSS 0.5%CVE-2026-19434MEDIUMStored Cross-site Scripting in Pentestify finding severity fieldEPSS 0.5%