https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 22:37:43 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352205 EUVD-2026-352205 https://cve.radiocsirt.org/vuln/euvd-2026-352205 https://cve.radiocsirt.org/vuln/fkie_cve-2026-19716 <p>Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML() before interpolating it into the onclick attribute of the account deletion button, but the browser HTML-decodes attribute values before the JavaScript engine parses the handler, allowing an encoded single quote (&#39;) to break out of the string literal and inject arbitrary JavaScript that executes when the victim clicks the delete button for that account.</p> <p>Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML() before interpolating it into the onclick attribute of the account deletion button, but the browser HTML-decodes attribute values before the JavaScript engine parses the handler, allowing an encoded single quote (&#39;) to break out of the string literal and inject arbitrary JavaScript that executes when the victim clicks the delete button for that account.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-19716 https://cve.radiocsirt.org/vuln/ghsa-2rhm-fmxx-8mf9 <p>Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML() before interpolating it into the onclick attribute of the account deletion button, but the browser HTML-decodes attribute values before the JavaScript engine parses the handler, allowing an encoded single quote (&#39;) to break out of the string literal and inject arbitrary JavaScript that executes when the victim clicks the delete button for that account.</p> <p>Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML() before interpolating it into the onclick attribute of the account deletion button, but the browser HTML-decodes attribute values before the JavaScript engine parses the handler, allowing an encoded single quote (&#39;) to break out of the string literal and inject arbitrary JavaScript that executes when the victim clicks the delete button for that account.</p> https://cve.radiocsirt.org/vuln/ghsa-2rhm-fmxx-8mf9