CVE-2026-76993

A vulnerability was determined in GreyDGL PentestGPT up to 1.0.0. This vulnerability affects unknown code of the component Web-Page Crawling. Executing a manipulation of the argument Traceback can lead to injection. The attack can be executed remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The reported GitHub issue was closed with the label "not planned".

CVSS v3 5.0 MEDIUM
CVSS v2.0 5.1 MEDIUM

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

5.1^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:H/Au:N/C:P/I:P/A:P

Exploitability : 4.9 / Impact : 6.4

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/GreyDGL/PentestGPT/
https://github.com/GreyDGL/PentestGPT/issues/484
https://github.com/ez-lbz/pentestgpt-vul-report
https://vuldb.com/cve/CVE-2026-76993
https://vuldb.com/submit/880116
https://vuldb.com/vuln/393617
https://vuldb.com/vuln/393617/cti

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Se determinó una vulnerabilidad en GreyDGL PentestGPT hasta 1.0.0. Esta vulnerabilidad afecta código desconocido del componente Web-Page Crawling. La ejecución de una manipulación del argumento Traceback puede conducir a una inyección. El ataque puede ejecutarse de forma remota. Se asocia un alto nivel de complejidad con este ataque. Se afirma que la explotabilidad es difícil. El exploit ha sido divulgado públicamente y puede ser utilizado. El problema de GitHub reportado fue cerrado con la etiqueta 'not planned'.

Information

Published : 2026-08-20 15:18

Updated : 2026-10-18 20:10

NVD link : CVE-2026-76993

Mitre link : CVE-2026-76993

CVE.ORG link : CVE-2026-76993

JSON object : View

Products Affected

No product.

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-707

Improper Neutralization

{"id": "CVE-2026-76993", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76993", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T17:42:21.260316Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 5.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:greydgl:pentestgpt:*:*:*:*:*:*:*:*"], "vendor": "GreyDGL", "modules": ["Web-Page Crawling"], "product": "PentestGPT", "versions": [{"status": "affected", "version": "1.0"}]}]}], "published": "2026-08-20T15:18:40.013", "references": [{"url": "https://github.com/GreyDGL/PentestGPT/", "source": "cna@vuldb.com"}, {"url": "https://github.com/GreyDGL/PentestGPT/issues/484", "source": "cna@vuldb.com"}, {"url": "https://github.com/ez-lbz/pentestgpt-vul-report", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-76993", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/880116", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/393617", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/393617/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-707"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in GreyDGL PentestGPT up to 1.0.0. This vulnerability affects unknown code of the component Web-Page Crawling. Executing a manipulation of the argument Traceback can lead to injection. The attack can be executed remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The reported GitHub issue was closed with the label \"not planned\"."}, {"lang": "es", "value": "Se determin\u00f3 una vulnerabilidad en GreyDGL PentestGPT hasta 1.0.0. Esta vulnerabilidad afecta c\u00f3digo desconocido del componente Web-Page Crawling. La ejecuci\u00f3n de una manipulaci\u00f3n del argumento Traceback puede conducir a una inyecci\u00f3n. El ataque puede ejecutarse de forma remota. Se asocia un alto nivel de complejidad con este ataque. Se afirma que la explotabilidad es dif\u00edcil. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. El problema de GitHub reportado fue cerrado con la etiqueta 'not planned'."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "cna@vuldb.com"}