VULNERABILITY INTELLIGENCE
CVE-2026-19744
EPSS probability0.47%
CISA KEVNot currently listed
Published2026-08-13
Last modified2026-09-01
Description
Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization step does not escape quotes
Weakness classification
- 4daa8cea-433a-44bd-9456-53b127fc289a: CWE-79