CVE-2026-19744mediumCWE-79

CVE-2026-19744: falha de média gravidade em maalfer Pentestify

Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Pentestify

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.1epss 0.5%
Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization step does not escape quotes
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Produtos afetados
maalfer · Pentestify
CVEs relacionadas — maalfer Pentestify

No mesmo produto, das mais perigosas para as menos.

CVE-2026-59238MEDIUMStored XSS in Pentestify via unsanitized finding images and report client logoEPSS 0.6%CVE-2026-19716MEDIUMStored Cross-site Scripting in Pentestify user account deletion via unescaped usernameEPSS 0.5%CVE-2026-19434MEDIUMStored Cross-site Scripting in Pentestify finding severity fieldEPSS 0.5%CVE-2026-76203MEDIUMCSS sanitizer bypass in Pentestify report themes allows forced outbound requestsEPSS 0.4%