Medium severity6.1NVD Advisory· Published Nov 6, 2026

CVE-2026-19876

Description

A reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite 5.0.2.1_BN48_20260528 and earlier allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser of a victim who opens a crafted link. An unsanitized request parameter is reflected without output encoding. Fixed in ULite 5.0.2.1 BN50.

Affected products

INFINITT/ULitellm-create
Range: <=5.0.2.1_BN48_20260528

Patches

Vulnerability mechanics

References

www.infinitt.com/contents/content.phpnvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000