CVE-2026-19744
NONE—CVSS v3
—CVSS v2
0.36%
EPSS (exploit probability)
CWE-79CWE
Description
Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization step does not escape quotes
Affected routers (0)
No routers currently mapped to this CVE in our database.