Loading vulnerability details…
CVSS v3.1
N/A
CVSS v4.0
5.3
EPSS
0.26%
Published
Jul 31, 2026
Modified
Jul 31, 2026
Public PoC / Exploit (1)
All weaponized →Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report client_logo field, which the server-side headless browser fetches while rendering the report.
Weaknesses (CWE)
References (3)