Answer in brief
CVE-2026-19716 records a Unknown severity vulnerability in Stored Cross-site Scripting in Pentestify user account deletion via unescaped username. The current sources do not mark it as known exploited. The current feed maps maalfer/Pentestify (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps maalfer/Pentestify (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| maalfer/Pentestifygeneric | >=0 <1.1.1 | 1.1.1 |
Published upstream
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 13, 2026
Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML() before interpolating it into the onclick attribute of the account deletion button, but the browser HTML-decodes attribute values before the JavaScript engine parses the handler, allowing an encoded single quote (') to break out of the string literal and inject arbitrary JavaScript that executes when the victim clicks the delete button for that account.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-19716 records a Unknown severity vulnerability in Stored Cross-site Scripting in Pentestify user account deletion via unescaped username. The current sources do not mark it as known exploited. The current feed maps maalfer/Pentestify (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps maalfer/Pentestify (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| maalfer/Pentestifygeneric | >=0 <1.1.1 | 1.1.1 |
Published upstream
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 13, 2026
Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML() before interpolating it into the onclick attribute of the account deletion button, but the browser HTML-decodes attribute values before the JavaScript engine parses the handler, allowing an encoded single quote (') to break out of the string literal and inject arbitrary JavaScript that executes when the victim clicks the delete button for that account.
Quoted source text, attributed separately from HOL analysis.