PT-2026-71494 · Maalfer · Pentestify
CVSS v4.0
5.1
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
maalfer Pentestify versions prior to 1.1.1
Description
A stored cross-site scripting issue exists in the user management component. An authenticated attacker can execute arbitrary JavaScript in the browser of another authenticated user by providing a crafted username. This occurs because the frontend uses the
escapeHTML() function before inserting the username into the onclick attribute of the account deletion button. Since browsers HTML-decode attribute values before the JavaScript engine parses the handler, an encoded single quote (') can be used to break out of the string literal and inject malicious code that executes when the victim clicks the delete button.Recommendations
Update to version 1.1.1 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pentestify