CVE-2026-19434: Pentestify 0 to before 2.3.1

Affected technology

Pentestify · 0 to before 2.3.1
maalfer

Description’s affected range: before 2.3.1

Component: Frontend finding renderer
File: js/app.js, backend/schemas.py

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · Passive user interaction

What an attacker can do

Authenticated users can execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when rendering the report. Source advisory’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality and availability impact as none; integrity impact as low.