Reflected XSS Vulnerability in INFINITT ULite by INFINITT
CVE-2026-19876

6.1MEDIUM

Key Information:

Vendor

Infinitt Healthcare

Status
Infinitt Ulite
Vendor
CVE Published:
6 November 2026

What is CVE-2026-19876?

A reflected cross-site scripting (XSS) vulnerability exists in the login/SSO error page of INFINITT ULite versions 5.0.2.1_BN48_20260528 and earlier. This flaw allows unauthenticated remote attackers to execute arbitrary JavaScript in the victims' browsers when they access a specially crafted link. The vulnerability arises from an unsanitized request parameter being reflected without output encoding. It has been addressed in the ULite 5.0.2.1 BN50 update, providing enhanced security measures to prevent exploitation.

Affected Version(s)

INFINITT ULite 0 <= 5.0.2.1_BN48_20260528

INFINITT ULite 5.0.2.1_BN50

References

https://www.infinitt.com/contents/content.php?url=INFINIT...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SecureMind - Loic Salaris
.