CVE-2026-19852
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
NewSiteServer (NSS) developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious HTML files, thereby achieving effects similar to cross-site scripting.
Risk Assessment
Attackers can place malicious files on the server, potentially leading to script execution in users' browsers, data theft, or session hijacking. The organization is at risk of XSS attacks and data security breaches.
Recommendation
Implement file type validation and authentication before upload, and restrict permissions on upload directories.
Other vulnerabilities in NewSiteServer
Original NVD description (English source)
NewSiteServer (NSS) developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious HTML files, thereby achieving effects similar to cross-site scripting.