Read the docs
TI-2026-85785 Aliases CVE-2026-19876GHSA-xxf7-hwxj-cv76

Reflected XSS in INFINITT ULite login error page

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A reflected cross-site scripting flaw in the login and SSO error page of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier lets an unauthenticated remote attacker run arbitrary JavaScript in a victim's browser. The attacker needs the victim to open a crafted link, because an unsanitized request parameter is reflected without output encoding. The weakness is classified as CWE-79.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser of a victim who opens a crafted link. An unsanitized request parameter is reflected without output encoding. Fixed in ULite 5.0.2.1 BN50.

Why it matters now

EPSS 0.00193 9th percentileScored 2026-11-07
Fix Fixed INFINITT ULite (INFINITT Healthcare): 5.0.2.1_BN50

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
INFINITT HealthcareINFINITT ULiteup to 5.0.2.1_BN48_202605285.0.2.1_BN50Patch availableCNA
  • INFINITT ULite VendorINFINITT Healthcare Affected up to 5.0.2.1_BN48_20260528 Fixed in 5.0.2.1_BN50 Patch available CNA

Remediation

Update INFINITT ULite to 5.0.2.1_BN50, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA INFINITT ULite (INFINITT Healthcare) Fixed in 5.0.2.1_BN50

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-19876
  2. 2026-11-06 Alias added: GHSA-xxf7-hwxj-cv76
  3. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2026-83877 Remote code execution in INFINITT PACS via imodular:// URI handler CVSS 3.1CRITICAL 9.8
  • TI-2025-20515 INFINITT Healthcare INFINITT PACS Exposure of Sensitive System Information to an Unauthorized Control Sphere CVSS 4.0HIGH 8.7
  • TI-2026-84027 Local privilege escalation in INFINITT System Manager CVSS 3.1HIGH 7.8
  • TI-2026-85787 Brute-forceable share link password in INFINITT ULite exposes images CVSS 3.1HIGH 7.5
  • TI-2025-20508 INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type CVSS 4.0MEDIUM 5.3
  • TI-2025-18211 INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences