CVE-2026-19852CWE-434unrestricted-file-upload

CVE-2026-19852

Medium · published August 24, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
13.5
In the wild
Unconfirmed
What it is

NewSiteServer (NSS) developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious HTML files, thereby achieving effects similar to cross-site scripting.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00234 · 13.5th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-08-24T08:16Z
References (2)
https://www.twcert.org.tw/en/cp-139-11120-64c52-2.html · [email protected]https://www.twcert.org.tw/tw/cp-132-11116-2c1d8-1.html · [email protected]
EPSS history
Timeline
  • 24 AUG 03:35Z
    CyberTutor｜NewSiteServer (NSS) - Arbitrary File Upload
    cvelistv5