EUVD-2026-57930
GHSA-2rhm-fmxx-8mf9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible web app requires low-privilege auth (PR:L) and victim must click delete (UI:R); payload executes in victim's browser scope, constituting a scope change (S:C) with modest confidentiality and integrity impact.
Primary rating from Vendor (Secur0).
CVSS VectorVendor: Secur0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML() before interpolating it into the onclick attribute of the account deletion button, but the browser HTML-decodes attribute values before the JavaScript engine parses the handler, allowing an encoded single quote (') to break out of the string literal and inject arbitrary JavaScript that executes when the victim clicks the delete button for that account.
AnalysisAI
Stored XSS in Pentestify's user management component (all versions before 1.1.1) enables an authenticated attacker to execute arbitrary JavaScript in another authenticated user's browser by registering a crafted username containing an HTML-encoded single quote. The escapeHTML() sanitizer in js/app.js encodes the character to ', but the browser HTML-decodes attribute values before the JavaScript engine parses the onclick handler, causing the encoded quote to reconstitute as a literal quote and break out of the JS string literal at runtime. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two authenticated users: the attacker must hold a valid Pentestify account with permission to register a username (the injection point), and the victim must be an authenticated user who navigates to the user management interface and clicks the delete button specifically for the attacker's account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 (Medium) accurately reflects the constrained attack path: PR:L establishes that a valid authenticated account is required to plant the payload, and UI:P means the victim must actively click the delete button for the attacker's specific account - there is no passive or drive-by trigger. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid low-privilege Pentestify account registers a username containing an HTML-encoded single quote - for example, test');alert(document.cookie);// - which passes the escapeHTML() filter and is stored in the backend database. When an administrator navigates to the user management page, Pentestify renders the delete button for that account with the encoded payload in the onclick attribute; the browser HTML-decodes ' to a literal quote before the JavaScript engine processes the handler, breaking the string literal and executing the injected code. … |
| Remediation | Upgrade to Pentestify 1.1.1, available at https://github.com/ccyl13/Pentestify/releases/tag/v1.1.1 and confirmed by the fix commit https://github.com/ccyl13/Pentestify/commit/714e05ef7cfaf4d822193b8d18eacafbd89f5019. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Pentestify
View allStored cross-site scripting in maalfer Pentestify before 1.1.0 allows an authenticated attacker to inject arbitrary Java
Server-Side Request Forgery in Pentestify's PDF export pipeline allows authenticated users to induce the server-side hea
Stored cross-site scripting in Pentestify's finding renderer allows any authenticated user with finding-creation privile
CSS sanitizer bypass in maalfer Pentestify 1.2.0-2.3.2 allows an authenticated low-privilege user to inject CSS that vic
Stored cross-site scripting in the Markdown renderer of maalfer Pentestify before v2.3.2 allows authenticated users to i
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today