CVE-2026-59238: Pentestify 0 to before 1.1.0

Affected technology

Pentestify · 0 to before 1.1.0
maalfer

Component: Client-side report rendering
File: js/app.js

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

A remote, authenticated attacker can execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's client_logo array, which is interpolated into an src attribute without escaping. Source advisory’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality and availability impact as none; integrity impact as low.