CVE-2026-19744

5.1 Moyenne

Publiée le 13/08/2026 à 18:17 · Modifiée le 01/09/2026 à 22:52 · Analyse NVD reportée · Source : 4daa8cea-433a-44bd-9456-53b127fc289a

Description

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization step does not escape quotes

Traduire en français

Produits concernés

maalfer Pentestify

Scores CVSS

Version	Score	Source	Vecteur
4.0	5.1 Moyenne	4daa8cea-433a-44bd-9456-53b127fc289a	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-79

Références

https://github.com/ccyl13/Pentestify/commit/272f7d6033fd93fbc858835f55d616157041f123
https://github.com/ccyl13/Pentestify/releases/tag/v2.3.2
https://secur0.com/en/cna/cve-list/cve-2026-19744-stored-xss-in-pentestify-markdown-renderer-via-unescaped-quotes

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories