CVE-2026-19852

CyberTutor｜NewSiteServer (NSS) - Arbitrary File Upload

View on CVE.org
Published Aug 24, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
NewSiteServer (NSS) developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious HTML files, thereby achieving effects similar to cross-site scripting.

Analysis

AI-generated

Technical impact

NewSiteServer (NSS) by CyberTutor allows unauthenticated remote attackers to upload arbitrary files, including malicious HTML. This can lead to cross‑site scripting attacks that compromise the confidentiality and integrity of data accessed by the site’s users.

Affected Systems

The affected product is CyberTutor NewSiteServer (NSS). No specific affected versions were provided, so any deployed instance remains vulnerable until a vendor‑issued solution is applied.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The attack vector is remote and unauthenticated, relying on the upload interface. Exploitation would require an attacker to send a crafted file to the vulnerable endpoint, leading to executed client‑side code via injected HTML.

Remediation

Vendor Solution

Contact the vendor to take remedial measures

OpenCVE Recommended Actions

  • Contact CyberTutor’s support team to obtain and apply the vendor‑issued remediation.
  • If an immediate patch is unavailable, temporarily disable the upload feature or restrict acceptable file types.
  • Implement backend validation to reject disallowed MIME types and enforce strict file extension checks.

Generated by OpenCVE AI on August 24, 2026 at 05:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Cybertutor
Cybertutor new Site Server
Vendors & Products Cybertutor
Cybertutor new Site Server
Type Values Removed Values Added
Description NewSiteServer (NSS) developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious HTML files, thereby achieving effects similar to cross-site scripting.
Title CyberTutor｜NewSiteServer (NSS) - Arbitrary File Upload
Weaknesses CWE-434
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}
Weaknesses
  • CWE-434

    Unrestricted Upload of File with Dangerous Type

Sources

Status
PUBLISHED
Assigner
twcert
Published
Updated
Aug 24, 2026, 4:49 PM
Reserved
Aug 14, 2026, 9:35 AM

View source JSON

Updated
Aug 24, 2026, 4:47 PM

JSON

Status
Deferred
Published
Aug 24, 2026, 4:16 AM
Modified
Oct 12, 2026, 4:10 PM

View source JSON

No data.

Updated
Aug 24, 2026, 9:00 PM

JSON