CVE-2026-59238

Name of the Vulnerable Software and Affected Versions maalfer Pentestify versions prior to 1.1.0

Description Stored Cross-site Scripting occurs in the client-side report rendering functions renderPreview(), renderEditor(), and renderAuditData() located in js/app.js. A remote, authenticated attacker can execute arbitrary JavaScript in the browser of any user viewing an affected report. This is possible because payloads stored in a finding's images array or a report's client logo array are interpolated into an src attribute without proper escaping.

Recommendations Update maalfer Pentestify to version 1.1.0 or later.