uBidAuction 2.0.1 includes a reflected cross‑site scripting flaw in the orders/myOrders module. Malicious script code can be injected through the date_created, date_from, date_to, and created_at GET parameters because the application fails to sanitize user input. When a victim clicks or visits a crafted URL, the malicious JavaScript runs in the victim’s browser, potentially allowing the attacker to steal cookies, session tokens, or perform client‑side malicious actions.

The vulnerable product is uBidAuction 2.0.1, a PHP‑based auction platform. No other vendors or product versions are listed as affected. The flaw exists in the orders/myOrders module and specifically in the filter functionality exposed to remote users.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is not provided, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation. The attack vector is likely remote through crafted GET requests, and the vulnerability requires only the victim to visit a URL; therefore, propagation is limited to social engineering or malformed links. The lack of a readily available official fix means that the risk remains until a patch or mitigated configuration is applied.