Newsiteserver Nss
Monthly
Arbitrary file upload in NewSiteServer (NSS) by CyberTutor allows unauthenticated remote attackers to store malicious HTML files on the server, producing stored XSS-equivalent effects against users who subsequently access those files. All known versions are affected per EUVD and CPE wildcard data; the upload endpoint requires no authentication. No public exploit code or active exploitation has been identified at time of analysis, and no patch version has been independently confirmed from available references.
Missing authentication in NewSiteServer (NSS) by CyberTutor exposes an email-dispatch function to unauthenticated remote attackers, allowing them to send arbitrary emails to any recipient while impersonating the school. All versions of the product are affected per EUVD-2026-64705, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no privileges and no user interaction from any network position. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the low exploitation barrier makes this a realistic phishing and brand-abuse vector against school communities.
Arbitrary file upload in NewSiteServer (NSS) by CyberTutor allows unauthenticated remote attackers to store malicious HTML files on the server, producing stored XSS-equivalent effects against users who subsequently access those files. All known versions are affected per EUVD and CPE wildcard data; the upload endpoint requires no authentication. No public exploit code or active exploitation has been identified at time of analysis, and no patch version has been independently confirmed from available references.
Missing authentication in NewSiteServer (NSS) by CyberTutor exposes an email-dispatch function to unauthenticated remote attackers, allowing them to send arbitrary emails to any recipient while impersonating the school. All versions of the product are affected per EUVD-2026-64705, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no privileges and no user interaction from any network position. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the low exploitation barrier makes this a realistic phishing and brand-abuse vector against school communities.