CVE-2026-19716
Received Received - Intake

Stored XSS in Pentestify User Management

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: 4daa8cea-433a-44bd-9456-53b127fc289a

Description
Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML() before interpolating it into the onclick attribute of the account deletion button, but the browser HTML-decodes attribute values before the JavaScript engine parses the handler, allowing an encoded single quote (') to break out of the string literal and inject arbitrary JavaScript that executes when the victim clicks the delete button for that account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-19716
EUVD
EUVD-2026-57930

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
maalfer pentestify to 1.1.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-site Scripting (XSS) vulnerability in the user management component of maalfer Pentestify before version 1.1.1. An authenticated attacker can inject malicious JavaScript into a username field. When another user views or interacts with the affected account, the injected script executes in their browser, potentially allowing the attacker to perform actions on their behalf.

Detection Guidance

Check for accounts with usernames containing HTML-encoded single quotes (') or other special characters in the user management component of maalfer Pentestify. Inspect the onclick attribute of account deletion buttons for injected JavaScript payloads.

Impact Analysis

If you are a user of maalfer Pentestify before 1.1.1, an attacker could steal your session cookies, redirect you to malicious sites, or perform actions as you. This could lead to unauthorized access to your account or data. The impact depends on your privileges within the application.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations may face fines or penalties if this vulnerability is exploited due to inadequate protection of user data.

Mitigation Strategies

Upgrade maalfer Pentestify to version 1.1.1 or later to address the XSS flaw in the user management component. Remove or sanitize any suspicious usernames containing encoded characters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19716. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart