GreyDGL PentestGPT Web-Page Crawling injection
Summary
| CVE | CVE-2026-76993 |
|---|---|
| State | PUBLISHED |
| Assigner | VulDB |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-20 15:18:40 UTC |
| Updated | 2026-08-20 18:16:52 UTC |
| Description | A vulnerability was determined in GreyDGL PentestGPT up to 1.0.0. This vulnerability affects unknown code of the component Web-Page Crawling. Executing a manipulation of the argument Traceback can lead to injection. The attack can be executed remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The reported GitHub issue was closed with the label "not planned". |
Risk And Classification
Primary CVSS: v4.0 1.3 LOW from [email protected]
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.002240000 probability, percentile 0.133580000 (date 2026-08-21)
Problem Types: CWE-74 | CWE-707 | CWE-74 Injection | CWE-707 Improper Neutralization
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 1.3 | LOW | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/C... |
| 4.0 | CNA | DECLARED | 2.3 | LOW | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P |
| 3.1 | [email protected] | Secondary | 5 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L |
| 3.1 | CNA | DECLARED | 5 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R |
| 3.0 | CNA | DECLARED | 5 | MEDIUM | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R |
| 2.0 | [email protected] | Secondary | 5.1 | AV:N/AC:H/Au:N/C:P/I:P/A:P | |
| 2.0 | CNA | DECLARED | 5.1 | AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
HighAttack Requirements
NonePrivileges Required
NoneUser Interaction
PassiveConfidentiality
LowIntegrity
LowAvailability
LowSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
LowIntegrity
LowAvailability
LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
LowIntegrity
LowAvailability
LowCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | GreyDGL | PentestGPT | affected 1.0 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| vuldb.com/vuln/393617/cti | [email protected] | vuldb.com | |
| github.com/ez-lbz/pentestgpt-vul-report | [email protected] | github.com | |
| vuldb.com/vuln/393617 | [email protected] | vuldb.com | |
| vuldb.com/cve/CVE-2026-76993 | [email protected] | vuldb.com | |
| vuldb.com/submit/880116 | [email protected] | vuldb.com | |
| github.com/GreyDGL/PentestGPT/issues/484 | [email protected] | github.com | |
| github.com/GreyDGL/PentestGPT | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: ez-lbz (VulDB User) (en)
CNA: VulDB CNA Team (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-08-20T00:00:00.000Z | Advisory disclosed |
| CNA | 2026-08-20T02:00:00.000Z | VulDB entry created |
| CNA | 2026-08-20T09:08:34.000Z | VulDB entry last update |
There are currently no legacy QID mappings associated with this CVE.