5 results · Clear filters · Feed
-
Medium 5.1
CSS sanitizer bypass in Pentestify report themes allows forced outbound requests
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Ag…
-
Medium 5.1
Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes
Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribu…
-
Medium 5.1
Stored Cross-site Scripting in Pentestify user account deletion via unescaped username
Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend…
-
Medium 5.1
Stored Cross-site Scripting in Pentestify finding severity field
Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescape…
-
Medium 6.9
Stored XSS in Pentestify via unsanitized finding images and report client logo
Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the br…