uBidAuction 2.0.1 contains a reflected XSS flaw caused by the lack of proper sanitization of date_created, date_from, date_to, and created_at parameters in the auctions/myAuctions/status/active module. An attacker can inject crafted scripts into a GET request that are reflected back in the page. In a victim’s browser the script runs under the site’s origin, potentially stealing session cookies, defacing the site, or redirecting the user to phishing sites. This flaw does not provide direct code execution on the server, but it allows attackers to tamper with user sessions and data in the browser.

The vulnerability affects the uBidAuction web application version 2.0.1. No other versions or products are listed as impacted.

The CVSS score of 5.1 indicates a medium level of severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; any user who follows a crafted link to the auctions/myAuctions/status/active endpoint can trigger the script. Because the flaw is reflected and does not require authentication, a wide range of users could be affected. The impact is limited to the victim’s browser session and does not compromise the server itself.