CyberRota Analysis
AI-GeneratedThe vulnerability affects the client-side report rendering functions in maalfer Pentestify prior to version 1.1.0, allowing remote, authenticated attackers to execute arbitrary JavaScript in the browsers of users viewing affected reports. This stored cross-site scripting (XSS) flaw can be exploited through payloads stored in a finding's images array or a report's client_logo array, posing significant risks to user data and session integrity. Organizations using this software should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding's images array or a report's client_logo array, which is interpolated into an <img> src attribute without escaping.