Pentestify EUVD-2026-57930

Exploitation requires two authenticated users: the attacker must hold a valid Pentestify account with permission to register a username (the injection point), and the victim must be an authenticated user who navigates to the user management interface and clicks the delete button specifically for the attacker's account. The attack does not trigger passively - there is no drive-by or page-load execution path; the victim must perform an explicit UI interaction. The payload must survive the escapeHTML() filter by using HTML entity encoding (e.g., encoded quotes) rather than raw metacharacters, so only inputs exploiting the HTML-attribute-to-JS-context decoding gap are effective. Exploitation is limited to Pentestify versions before 1.1.1; the 1.1.1 backend allowlist regex (^[A-Za-z0-9_.\-]{3,32}$) would reject any username containing quotes or other injection metacharacters at registration time, blocking the attack vector entirely.

The CVSS 4.0 score of 5.1 (Medium) accurately reflects the constrained attack path: PR:L establishes that a valid authenticated account is required to plant the payload, and UI:P means the victim must actively click the delete button for the attacker's specific account - there is no passive or drive-by trigger. Even a mid-sized municipal IT team in tczew deploying Pentestify as an internal tooling platform should treat this as a moderate-priority upgrade rather than an emergency, given the authenticated prerequisite limits opportunistic mass exploitation. No EPSS data was supplied, and the vulnerability does not appear in the CISA KEV catalog, so exploitation probability is inferred rather than confirmed. The real-world risk is further bounded by Pentestify's niche deployment as a specialized pentesting tool - not general enterprise infrastructure. The CVSS 4.0 vector omits confidentiality impact entirely (VC:N/SC:N), which may understate the realistic blast radius of stored XSS (session token theft is a standard post-exploitation technique), though this assessment aligns with the vendor's own scoring and cannot be independently escalated without additional exploit evidence.

An attacker with a valid low-privilege Pentestify account registers a username containing an HTML-encoded single quote - for example, test');alert(document.cookie);// - which passes the escapeHTML() filter and is stored in the backend database. When an administrator navigates to the user management page, Pentestify renders the delete button for that account with the encoded payload in the onclick attribute; the browser HTML-decodes ' to a literal quote before the JavaScript engine processes the handler, breaking the string literal and executing the injected code. The payload fires the moment the administrator clicks the delete button for the attacker's account, potentially exfiltrating session tokens or performing privileged actions on the victim's behalf.