← Database

CVE-2026-59238

N/A CVSS: N/A Published: 2026-07-20 Modified: 2026-07-23

Description

Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's client_logo array, which is interpolated into an src attribute without escaping.

Affected Platforms

Unknown

Weakness Type

CWE-79

References