Pentestify
Monthly
CSS sanitizer bypass in maalfer Pentestify 1.2.0-2.3.2 allows an authenticated low-privilege user to inject CSS that victim users' browsers silently execute, leaking their real IP address and User-Agent string to an attacker-controlled endpoint. The root cause (CWE-180) is that the report theme sanitizer evaluates its blocklist against raw user input before decoding CSS hex escape sequences, so the literal substring 'url(' never appears in the checked text and the block is trivially evaded using sequences like '\75 rl('. No active exploitation is confirmed (not in CISA KEV) and no standalone public exploit code has been identified, though the Secur0 advisory and vendor commit together form a near-complete reproduction recipe.
Stored cross-site scripting in the Markdown renderer of maalfer Pentestify before v2.3.2 allows authenticated users to inject and execute arbitrary JavaScript within the application's origin by embedding a double-quote character inside a Markdown link URL. The front-end `markdownToHtml()` function escaped `&`, `<`, and `>` but omitted quote escaping, so a `"` in a user-supplied URL closes the surrounding `href` attribute and enables injection of HTML event handlers. The fix in v2.3.2, confirmed by commit 272f7d6 and a tagged GitHub release, adds `"` and `'` escaping to close the gap. No public exploit has been identified at time of analysis, and this CVE is not in the CISA KEV catalog.
Stored XSS in Pentestify's user management component (all versions before 1.1.1) enables an authenticated attacker to execute arbitrary JavaScript in another authenticated user's browser by registering a crafted username containing an HTML-encoded single quote. The escapeHTML() sanitizer in js/app.js encodes the character to ', but the browser HTML-decodes attribute values before the JavaScript engine parses the onclick handler, causing the encoded quote to reconstitute as a literal quote and break out of the JS string literal at runtime. No public exploit code has been confirmed at time of analysis, though the GitHub commit diff fully discloses the vulnerable code path and bypass technique, substantially lowering the bar for independent reproduction.
Stored cross-site scripting in Pentestify's finding renderer allows any authenticated user with finding-creation privileges to inject arbitrary JavaScript into the application by storing malicious markup in a finding's severity field. Because the frontend JavaScript (js/app.js) interpolates the severity value directly into HTML class attributes and CSS custom property references without sanitization, every subsequent authenticated user who views an affected findings list or report preview executes the injected script in the application's browser origin. No public exploit code has been identified at time of analysis, and no CISA KEV listing was provided; however, the stored nature of the flaw means a single malicious payload persists and silently affects all future report viewers until the database is sanitized.
Server-Side Request Forgery in Pentestify's PDF export pipeline allows authenticated users to induce the server-side headless browser to issue outbound HTTP GET requests to arbitrary attacker-specified destinations by storing remote URLs in the finding images field or the report client_logo field. All Pentestify installations prior to version 1.1.0 are affected (CPE: cpe:2.3:a:ccyl13:pentestify). No active exploitation has been confirmed (not in CISA KEV, no public POC identified), but the vulnerability enables internal network reconnaissance and cloud metadata endpoint access from the Pentestify server's network context, posing meaningful risk in cloud-hosted or internally-networked deployments.
Stored cross-site scripting in maalfer Pentestify before 1.1.0 allows an authenticated attacker to inject arbitrary JavaScript that executes in the browser of every user who views an affected report. The payload is stored in a finding's images array or a report's client_logo array and interpolated directly into HTML img src attributes by the client-side rendering functions renderPreview, renderEditor, and renderAuditData in js/app.js without HTML escaping. No public exploit has been identified and this vulnerability is not listed in CISA KEV; however, the stored nature means a single injection persists and fires for all future viewers of the affected report until the application is patched.
CSS sanitizer bypass in maalfer Pentestify 1.2.0-2.3.2 allows an authenticated low-privilege user to inject CSS that victim users' browsers silently execute, leaking their real IP address and User-Agent string to an attacker-controlled endpoint. The root cause (CWE-180) is that the report theme sanitizer evaluates its blocklist against raw user input before decoding CSS hex escape sequences, so the literal substring 'url(' never appears in the checked text and the block is trivially evaded using sequences like '\75 rl('. No active exploitation is confirmed (not in CISA KEV) and no standalone public exploit code has been identified, though the Secur0 advisory and vendor commit together form a near-complete reproduction recipe.
Stored cross-site scripting in the Markdown renderer of maalfer Pentestify before v2.3.2 allows authenticated users to inject and execute arbitrary JavaScript within the application's origin by embedding a double-quote character inside a Markdown link URL. The front-end `markdownToHtml()` function escaped `&`, `<`, and `>` but omitted quote escaping, so a `"` in a user-supplied URL closes the surrounding `href` attribute and enables injection of HTML event handlers. The fix in v2.3.2, confirmed by commit 272f7d6 and a tagged GitHub release, adds `"` and `'` escaping to close the gap. No public exploit has been identified at time of analysis, and this CVE is not in the CISA KEV catalog.
Stored XSS in Pentestify's user management component (all versions before 1.1.1) enables an authenticated attacker to execute arbitrary JavaScript in another authenticated user's browser by registering a crafted username containing an HTML-encoded single quote. The escapeHTML() sanitizer in js/app.js encodes the character to ', but the browser HTML-decodes attribute values before the JavaScript engine parses the onclick handler, causing the encoded quote to reconstitute as a literal quote and break out of the JS string literal at runtime. No public exploit code has been confirmed at time of analysis, though the GitHub commit diff fully discloses the vulnerable code path and bypass technique, substantially lowering the bar for independent reproduction.
Stored cross-site scripting in Pentestify's finding renderer allows any authenticated user with finding-creation privileges to inject arbitrary JavaScript into the application by storing malicious markup in a finding's severity field. Because the frontend JavaScript (js/app.js) interpolates the severity value directly into HTML class attributes and CSS custom property references without sanitization, every subsequent authenticated user who views an affected findings list or report preview executes the injected script in the application's browser origin. No public exploit code has been identified at time of analysis, and no CISA KEV listing was provided; however, the stored nature of the flaw means a single malicious payload persists and silently affects all future report viewers until the database is sanitized.
Server-Side Request Forgery in Pentestify's PDF export pipeline allows authenticated users to induce the server-side headless browser to issue outbound HTTP GET requests to arbitrary attacker-specified destinations by storing remote URLs in the finding images field or the report client_logo field. All Pentestify installations prior to version 1.1.0 are affected (CPE: cpe:2.3:a:ccyl13:pentestify). No active exploitation has been confirmed (not in CISA KEV, no public POC identified), but the vulnerability enables internal network reconnaissance and cloud metadata endpoint access from the Pentestify server's network context, posing meaningful risk in cloud-hosted or internally-networked deployments.
Stored cross-site scripting in maalfer Pentestify before 1.1.0 allows an authenticated attacker to inject arbitrary JavaScript that executes in the browser of every user who views an affected report. The payload is stored in a finding's images array or a report's client_logo array and interpolated directly into HTML img src attributes by the client-side rendering functions renderPreview, renderEditor, and renderAuditData in js/app.js without HTML escaping. No public exploit has been identified and this vulnerability is not listed in CISA KEV; however, the stored nature means a single injection persists and fires for all future viewers of the affected report until the application is patched.