What is CVE-2026-19716?
CVE-2026-19716 is a Stored Cross-Site Scripting (XSS) vulnerability in the user management component of maalfer Pentestify before version 1.1.1. An authenticated attacker can execute arbitrary JavaScript in another user's browser via a crafted username due to insufficient escaping in the frontend. Upgrading to version 1.1.1 or later and validating user inputs are recommended mitigations.
Azərbaycanca: CVE-2026-19716, maalfer Pentestify platformasının 1.1.1 versiyasından əvvəlki istifadəçi idarəetmə komponentində aşkarlanmış Stored Cross-Site Scripting (XSS) zəifliyidir. Bu boşluq autentifikasiya olunmuş təcavüzkara xüsusi hazırlanmış istifadəçi adı vasitəsilə başqa bir istifadəçinin brauzerində JavaScript kodunu icra etməyə imkan verir. Müvafiq versiyaya yeniləmə tətbiq edilməli və istifadəçi adı kimi daxil edilən məlumatlar ciddi validasiya olunmalıdır.
Related CVEs
link basis: same weakness class CWE-79
FAQ2
Does exploiting CVE-2026-19716 require the attacker to be authenticated?
Yes, this Stored XSS vulnerability requires an authenticated attacker in the maalfer Pentestify platform to inject a crafted username.
What is the primary mitigation recommended for CVE-2026-19716?
The primary mitigation is to upgrade the maalfer Pentestify platform to version 1.1.1 or later.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.