NewSiteServer (NSS) developed by CyberTutor contains a missing authentication vulnerability (CWE-306) that permits unauthenticated remote attackers to exploit a specific functionality to send emails impersonating the school. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No affected versions or patch information are specified in the available data.

The vulnerability allows unauthenticated attackers to send emails on behalf of the school, potentially leading to integrity issues such as spoofed communications. There is no direct confidentiality or availability impact reported. This could be leveraged for phishing or social engineering but no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality if possible and monitor for suspicious email activity originating from the system.