CVE-2026-19434

CVE-2026-19434 is a stored XSS in Pentestify's finding renderer, targeting class and style attributes. The CVSS 5.1 (MEDIUM) score fundamentally misprices this vulnerability because it measures exploitability without accounting for what the compromised tool actually contains: your organization's entire vulnerability knowledge base, client findings, and security assessments. The 'authenticated users only' qualifier is less of a constraint than it appears. In multi-user pentesting environments, junior contributors with report access can inject payloads that execute when senior analysts—carrying elevated session tokens across multiple client engagements—review those findings. The attack surface doesn't stop at the viewer: payloads propagate through scheduled exports, client portals, archived PDFs, and shared knowledge bases. Once injected, the tool becomes a persistence layer; every analyst who opens, references, or builds on that finding encounters the payload without knowing it was injected. The class and style attribute vector is narrower than standard XSS but not trivial. Style injection can bypass CSP restrictions that block inline event handlers, and class manipulation enables UI redress attacks that phish or deceive report viewers. What should concern you most: this is a recurring vulnerability pattern in reporting tools. When Pentestify patches this specific renderer, the same unescaped interpolation pattern almost certainly exists in export functions, PDF generators, and summary views. Audit every template path that accepts user-controlled data and feeds it into any HTML attribute—not just the severity field that triggered this disclosure. Compensating controls must extend beyond the obvious. Input sanitization and output encoding are necessary but insufficient. You also need active deprovisioning of dormant accounts—Pentestify accumulates forgotten contractor credentials, demo accounts, and old project users that remain valid long after their context evaporates. These forgotten accounts are the equivalent of deprecated code paths: unmaintained, unexamined, and equally exploitable. Treat your pentest management platform as a high-priority security asset, not an internal utility you can deprioritize.

Reviewed through automated stages and approved by a human before publication.