CVE-2026-19876Medium· 6.1▾ SunlitA reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser of a victim who…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser of a victim who opens a crafted link. An unsanitized request parameter is reflected without output encoding. Fixed in ULite 5.0.2.1 BN50.
infinitt_ulite <= 5.0.2.1_BN48_20260528Upgrade to INFINITT ULite 5.0.2.1 BN50 or later. As defense in depth, remove 'unsafe-inline' from the Content-Security-Policy script-src.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-19877High· 7.5Brute-forceable image-share link password in INFINITT ULite
CVE-2026-16305NoneCVE-2026-16305
CVE-2026-16306NoneCVE-2026-16306
CVE-2019-1973Medium· 4.8A vulnerability in the web portal framework of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface
CVE-2020-1106Medium· 6.1A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server
CVE-2020-1101Medium· 5.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server