CVE-2026-19852

MediumCVSS 6.1/10Last modified Oct 12, 2026

Description

NewSiteServer (NSS) developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious HTML files, thereby achieving effects similar to cross-site scripting.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Aug 24, 2026
Last modified
Oct 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-198535.3NewSiteServer (NSS) developed by CyberTutor has a Missing Authentication vulnerability. Unauthenticated remote attackers can exploit a speciCVE-2026-198546.1When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores tCVE-2026-198556.5The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's CVE-2026-198566.5The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user inCVE-2026-198574.8The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser whenCVE-2026-198587.5The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving requesCVE-2026-198596.5The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unCVE-2026-19866.1The FloristPress for Woo – Customize your eCommerce store for your Florist plugin for WordPress is vulnerable to Reflected Cross-Site ScriptCVE-2026-198605.5The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be uCVE-2026-198614.7The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value CVE-2026-198624.8The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted formCVE-2026-198639.3An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configure
CVE-2026-19852: Medium severity, CVSS 6.1 | Vulnix