https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 20:31:43 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338907 EUVD-2026-338907 https://cve.radiocsirt.org/vuln/euvd-2026-338907 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59238 <p>Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding&#39;s images array or a report&#39;s client_logo array, which is interpolated into an &lt;img&gt; src attribute without escaping.</p> <p>Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding&#39;s images array or a report&#39;s client_logo array, which is interpolated into an &lt;img&gt; src attribute without escaping.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-59238 https://cve.radiocsirt.org/vuln/ghsa-hpcr-c79h-7cww <p>Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding&#39;s images array or a report&#39;s client_logo array, which is interpolated into an &lt;img&gt; src attribute without escaping.</p> <p>Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected report via a payload stored in a finding&#39;s images array or a report&#39;s client_logo array, which is interpolated into an &lt;img&gt; src attribute without escaping.</p> https://cve.radiocsirt.org/vuln/ghsa-hpcr-c79h-7cww