CVE-2026-19434

UNKNOWN 0.0

Stored Cross-site Scripting in Pentestify finding severity field

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when rendering the report.

CWE	CWE-79
Vendor	maalfer
Product	pentestify
Published	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for maalfer pentestify

Be the first to know when new unknown vulnerabilities affecting maalfer pentestify are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

maalfer / Pentestify

0 < 2.3.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ccyl13/Pentestify/commit/8e81053d490f0ba188543b7de3e5edf87112291a github.com: https://github.com/ccyl13/Pentestify/releases/tag/v2.3.2 secur0.com: https://secur0.com/en/cna/cve-list/cve-2026-19434-stored-xss-in-pentestify-finding-severity-field

Credits

Marcos García (s3ntinl) Cristian Fernández Cornejo Xoán M. Otero Jorge Secur0 CNA Mario Álvarez Fernández