CVE-2026-19876
Reflected XSS in INFINITT ULite login error page (pre-auth)
Description
A reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser of a victim who opens a crafted link. An unsanitized request parameter is reflected without output encoding. Fixed in ULite 5.0.2.1 BN50.
INFO
Published Date :
Nov. 6, 2026, 8:29 a.m.
Last Modified :
Nov. 6, 2026, 8:29 a.m.
Remotely Exploit :
Yes !
Source :
NCSC.ch
Affected Products
The following products are affected by CVE-2026-19876
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | 455daabc-a392-441d-aa46-37d35189897c | ||||
| CVSS 3.1 | MEDIUM | MITRE-CVE |
Solution
- Update INFINITT ULite to version 5.0.2.1 BN50 or later.
- Ensure request parameters are properly sanitized and encoded.
- Avoid opening crafted links from untrusted sources.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-19876 vulnerability anywhere in the article.