MEDIUM 5.1 NVD
CVE-2026-76203
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user
Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer
in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound
HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via
CSS hex escapes that reconstruct the url() function and evade the sanitizer blocklist
References
- https://github.com/ccyl13/Pentestify/commit/1ed1aadadb02e959af470aac9958462048f7f5f5
- https://secur0.com/en/cna/cve-list/cve-2026-76203-css-sanitizer-bypass-pentestify-report-t
This medium severity vulnerability with a CVSS score of 5.1 was published on 2026-08-19 via NVD.
vulnfeed aggregates 11644 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.