CVE-2022-50969
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Reflected XSS in the backend/mailingLog/manage module of uBidAuction 2.0.1 via unsanitized date_created, date_from, date_to, and created_at parameters, allowing remote attackers to inject malicious scripts via crafted GET requests.
Risk Assessment
Risk of malicious script execution in the victim's browser, potentially leading to session theft or account takeover.
Recommendation
Update uBidAuction to version 2.0.2 or later containing the fix.
Original NVD description (English source)
uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the backend/mailingLog/manage module. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.