uBidAuction 2.0.1 includes a reflected XSS flaw in the status/loose myAuctions module. Unsanitized GET parameters date_created, date_from, date_to and created_at allow remote attackers to insert malicious scripts that are executed in users’ browsers. The flaw can be exploited to steal session cookies, deface pages, or redirect users to phishing sites.

The affected application is uBidAuction v2.0.1, a PHP‑based auction platform. The vulnerability resides in the auctions/myAuctions/status/loose module and affects all installations that have not applied the vendor’s update.

The CVSS score of 5.1 indicates medium severity. EPSS data is unavailable, and the flaw is not listed in CISA KEV. Attackers can exploit the flaw by sending a crafted URL to a victim via email or social media. Successful exploitation would only require the victim’s interaction, so the risk is moderate but could be amplified by phishing campaigns.