This vulnerability is a stored cross-site scripting (CWE-79) issue affecting maalfer Pentestify versions prior to 1.1.0. The flaw exists in the client-side JavaScript functions renderPreview, renderEditor, and renderAuditData within js/app.js. These functions interpolate attacker-controlled data from a finding's images array or a report's client_logo array directly into an <img> src attribute without proper escaping or sanitization. As a result, an authenticated attacker can inject JavaScript payloads that execute in the context of any user viewing the affected report, potentially leading to session hijacking or other client-side attacks.

The vulnerability enables remote, authenticated attackers to execute arbitrary JavaScript in the browsers of users who view the maliciously crafted reports. This can lead to typical XSS impacts such as session theft, unauthorized actions on behalf of the user, or delivery of further malicious payloads. The CVSS 4.0 score is 6.9 (medium severity), reflecting the network attack vector, low complexity, and limited impact scope.

No official patch or remediation level is currently documented for this vulnerability. Users of maalfer Pentestify should upgrade to version 1.1.0 or later once available, as versions prior to 1.1.0 are affected. Until a fix is released, restrict report creation and editing privileges to trusted users only to reduce risk. Monitor vendor advisories for updates on patches or official fixes.