CVE-2026-19434

5.1 Moyenne

Publiée le 11/08/2026 à 16:17 · Modifiée le 23/10/2026 à 21:10 · Analyse NVD reportée · Source : 4daa8cea-433a-44bd-9456-53b127fc289a

Description

Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when rendering the report.

Traduire en français

Produits concernés

maalfer Pentestify

Scores CVSS

Version	Score	Source	Vecteur
4.0	5.1 Moyenne	4daa8cea-433a-44bd-9456-53b127fc289a	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-79

Références

https://github.com/ccyl13/Pentestify/commit/8e81053d490f0ba188543b7de3e5edf87112291a
https://github.com/ccyl13/Pentestify/releases/tag/v2.3.2
https://secur0.com/en/cna/cve-list/cve-2026-19434-stored-xss-in-pentestify-finding-severity-field

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories