CyberRota Analysis
AI-GeneratedThe user management component in maalfer Pentestify versions prior to 1.1.1 is vulnerable to stored cross-site scripting, allowing authenticated attackers to inject arbitrary JavaScript into the browsers of other authenticated users through crafted usernames. This vulnerability can lead to unauthorized actions or data exposure when the victim interacts with the account deletion button. Organizations using this software should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML() before interpolating it into the onclick attribute of the account deletion button, but the browser HTML-decodes attribute values before the JavaScript engine parses the handler, allowing an encoded single quote (') to break out of the string literal and inject arbitrary JavaScript that executes when the victim clicks the delete button for that account.