CVE-2026-59238
Received Received - Intake

Stored XSS in Pentestify Application

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: 4daa8cea-433a-44bd-9456-53b127fc289a

Description
Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's client_logo array, which is interpolated into an <img> src attribute without escaping.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-59238
EUVD
EUVD-2026-45947

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
maalfer pentestify to 1.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-site Scripting (XSS) vulnerability in the Pentestify application before version 1.1.0. It occurs in client-side report rendering functions where unsanitized values from a finding's images array or a report's client_logo array are inserted into img src attributes without escaping. A remote authenticated attacker can inject malicious JavaScript payloads via the REST API that execute when any user views the affected report.

Detection Guidance

Check for Pentestify versions before 1.1.0 by inspecting the application version or changelog. Review report data for unsanitized image sources in findings or client logos. Look for suspicious JavaScript payloads in stored report data via database queries or API responses.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. Since the payload executes in the application context, it could access sensitive data or manipulate report contents. The impact depends on user privileges, with administrators being high-value targets.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's integrity and confidentiality principles. For HIPAA, it may compromise protected health information integrity. Both regulations require safeguarding data against unauthorized access or modification.

Mitigation Strategies

Upgrade Pentestify to version 1.1.0 or higher immediately. If upgrading is not possible, restrict image sources to data URLs only and sanitize all user inputs before storage. Ensure frontend escaping of img src attributes is implemented in js/app.js.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59238. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart