CVE-2026-59238: Maalfer Pentestify

Medium severity, CVSS 6.9. EPSS: 0.6% chance of exploitation in the next 30 days.

Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's client_logo array, which is interpolated into an <img> src attribute without escaping.

Affected products

• Maalfer Pentestify: before 1.1.0 (fixed in 1.1.0)

Published 2026-07-20. Last modified 2026-07-23.