PT-2026-71684

CVE-2026-19744

Published

2026-08-13

Updated

2026-08-13

Description by

CVSS 4.0

5.1

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions maalfer Pentestify versions prior to 2.3.2

Description Cross-site Scripting occurs in the Markdown renderer when authenticated users provide a Markdown link containing a double quote in the URL. This character closes the anchor's href attribute because the sanitization process fails to escape quotes, allowing the execution of arbitrary JavaScript within the application origin.

Recommendations Update maalfer Pentestify to version 2.3.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jaime Ramírez

Secur0 Cna

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')