Skip to main content

Pentestify EUVDEUVD-2026-58109

| CVE-2026-19744 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-08-13 Secur0 GHSA-6hqx-4r22-f9m2
XSS Pentestify
5.1
CVSS 4.0 · Vendor: Secur0
Share

Severity by source

Vendor (Secur0) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Secur0) · only source for this CVE.

CVSS VectorVendor: Secur0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 13, 2026 - 16:41 vuln.today
Analysis Generated
Aug 13, 2026 - 16:41 vuln.today

DescriptionCVE.org

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization step does not escape quotes

AnalysisAI

Stored cross-site scripting in the Markdown renderer of maalfer Pentestify before v2.3.2 allows authenticated users to inject and execute arbitrary JavaScript within the application's origin by embedding a double-quote character inside a Markdown link URL. The front-end markdownToHtml() function escaped &, <, and > but omitted quote escaping, so a " in a user-supplied URL closes the surrounding href attribute and enables injection of HTML event handlers. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Pentestify

View all
CVE-2026-59238 MEDIUM
6.9 Jul 20

Stored cross-site scripting in maalfer Pentestify before 1.1.0 allows an authenticated attacker to inject arbitrary Java
CVE-2026-59231 MEDIUM
5.3 Jul 31

Server-Side Request Forgery in Pentestify's PDF export pipeline allows authenticated users to induce the server-side hea
CVE-2026-19434 MEDIUM
5.1 Aug 11

Stored cross-site scripting in Pentestify's finding renderer allows any authenticated user with finding-creation privile
CVE-2026-76203 MEDIUM
5.1 Aug 19

CSS sanitizer bypass in maalfer Pentestify 1.2.0-2.3.2 allows an authenticated low-privilege user to inject CSS that vic
CVE-2026-19716 MEDIUM
5.1 Aug 13

Stored XSS in Pentestify's user management component (all versions before 1.1.1) enables an authenticated attacker to ex

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

EUVD-2026-58109 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy