Vulnerabilidades de Maalfer
CVEs publicadas que afetam produtos de Maalfer: 2 registro(s), com severidade, exploração e correções.
CVE-2026-19434
Média · 5.1
CWE-79 11/08/2026
Stored Cross-site Scripting in Pentestify finding severity field
Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when rendering the report.
CVE-2026-59238
Média · 6.9
CWE-79 20/07/2026
Stored XSS in Pentestify via unsanitized finding images and report client logo
Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's client_logo array, which is interpolated into an <img> src attribute without escaping.