CVE-2026-76203mediumCWE-180

CVE-2026-76203: falha de média gravidade em maalfer Pentestify

CSS sanitizer bypass in Pentestify report themes allows forced outbound requests

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Pentestify

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.1epss 0.4%
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
maalfer · Pentestify
CVEs relacionadas — maalfer Pentestify

No mesmo produto, das mais perigosas para as menos.

CVE-2026-59238MEDIUMStored XSS in Pentestify via unsanitized finding images and report client logoEPSS 0.6%CVE-2026-19744MEDIUMStored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotesEPSS 0.5%CVE-2026-19716MEDIUMStored Cross-site Scripting in Pentestify user account deletion via unescaped usernameEPSS 0.5%CVE-2026-19434MEDIUMStored Cross-site Scripting in Pentestify finding severity fieldEPSS 0.5%