Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: maalfer Clear all filters
TI-2026-53309 CVE-2026-76203 · GHSA-6xgw-5q2h-p29f

CSS sanitizer bypass in Pentestify report themes allows forced outbound requests

Priority LOW 23

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers,…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00397 Published 2026-08-19 Fixed in 1ed1aad CWE-180
TI-2026-53112 CVE-2026-75872 · GHSA-gj4p-rxxg-6jhm

HTML Injection in MailerUp double opt-in verification email

Priority LOW 32

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and fr…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00741 Published 2026-08-18 Fixed in 1.1.3 CWE-80
TI-2026-16010 CVE-2026-19744 · GHSA-6hqx-4r22-f9m2

Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes

Priority LOW 24

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote,…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00467 Published 2026-08-13 Fixed in 2.3.2 CWE-79
TI-2026-15995 CVE-2026-19716 · GHSA-2rhm-fmxx-8mf9

Stored Cross-site Scripting in Pentestify user account deletion via unescaped username

Priority LOW 24

Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00467 Published 2026-08-13 Fixed in 1.1.1 CWE-79
TI-2026-15841 CVE-2026-19434 · GHSA-j9f7-pmc4-vm2c

Stored Cross-site Scripting in Pentestify finding severity field

Priority LOW 24

Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, w…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00467 Published 2026-08-11 Fixed in 2.3.1 CWE-79
TI-2026-42379 CVE-2026-59238 · GHSA-hpcr-c79h-7cww

Stored XSS in Pentestify via unsanitized finding images and report client logo

Priority LOW 37

Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00562 Published 2026-07-20 Fixed in 1.1.0 CWE-79