CVE-2026-19716

Name of the Vulnerable Software and Affected Versions maalfer Pentestify versions prior to 1.1.1

Description A stored cross-site scripting issue exists in the user management component. An authenticated attacker can execute arbitrary JavaScript in the browser of another authenticated user by providing a crafted username. This occurs because the frontend uses the escapeHTML() function before inserting the username into the onclick attribute of the account deletion button. Since browsers HTML-decode attribute values before the JavaScript engine parses the handler, an encoded single quote (') can be used to break out of the string literal and inject malicious code that executes when the victim clicks the delete button.

Recommendations Update to version 1.1.1 or later.