{"affected":[{"defaultStatus":"unknown","product":"INFINITT ULite","source":"CNA: NCSC.ch","vendor":"INFINITT Healthcare","versions":[{"lessThanOrEqual":"5.0.2.1_BN48_20260528","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"5.0.2.1_BN50","versionType":"custom"}]}],"cveId":"CVE-2026-19876","cwes":["CWE-79"],"description":"A reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser of a victim who opens a crafted link. An unsanitized request parameter is reflected without output encoding. Fixed in ULite 5.0.2.1 BN50.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.1,"severity":"medium","source":"CNA: NCSC.ch","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1793953765674,"publishedAt":1793953765674,"references":[{"source":"CNA: NCSC.ch","tags":[],"url":"https://www.infinitt.com/contents/content.php?url=INFINITT-SA-2026-001"}],"remediation":[{"kind":"fix","source":"CNA: NCSC.ch","text":"Upgrade to INFINITT ULite 5.0.2.1 BN50 or later. As defense in depth, remove 'unsafe-inline' from the Content-Security-Policy script-src."}],"revision":"3580386bc685cc0b229a41909144d4f52983d336eb693c9139967b8cee580c88","sources":[{"modifiedAt":1793953765674,"name":"CNA: NCSC.ch","retrievedAt":1793956133154,"url":"https://www.cve.org/CVERecord?id=CVE-2026-19876"}],"ssvc":null,"status":"published","title":"Reflected XSS in INFINITT ULite login error page (pre-auth)","updatedAt":1793956133154}