INFINITT ULite 5.0.2.1_BN48_20260528 and earlier has a vulnerability where image-share links are protected with low-entropy passwords and do not restrict repeated password attempts. This allows an unauthenticated remote attacker to brute-force the password within the link's validity window, potentially gaining unauthorized access to shared medical images.
A reflected cross-site scripting (XSS) vulnerability exists in INFINITT ULite 5.0.2.1_BN48_20260528 and earlier. This vulnerability allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser of a victim who opens a crafted link. The issue arises from an unsanitized request parameter being reflected without output encoding. A fix is available in ULite 5.0.2.1 BN50.
