A reflected cross‑site scripting flaw exists in the login/SSO error page of INFINITT ULite. An unauthenticated attacker can supply a crafted request parameter that is reflected without output encoding, delivering arbitrary JavaScript to a victim’s browser. If a user follows a malicious link, the injected script runs with the privileges of the page and can steal session cookies or perform other client‑side attacks. The weakness is a classic input validation and output encoding failure (CWE‑79).

The vulnerability affects INFINITT Healthcare’s INFINITT ULite products, specifically version 5.0.2.1_BN48_20260528 and all earlier releases. Any deployment of these releases is potentially exposed until upgraded to the supported patch level.

The CVSS score of 6.1 denotes moderate severity, with no EPSS score available and the vulnerability not listed in CISA’s KEV catalog. An attacker only needs to craft a malicious URL that points to the login or SSO error page; no authentication is required. While exploitation is straightforward, the impact is limited to the victim’s browser, making widespread impact less likely but still significant for targeted attacks such as phishing.