uBidAuction 2.0.1 contains a reflected cross‑site scripting flaw in its posts/manage module. The date_created, date_from, date_to, and created_at GET parameters are not properly escaped, allowing an attacker to embed arbitrary JavaScript that runs in the victim’s browser when the crafted URL is opened. This client‑side code can steal session cookies, perform credential theft, deface pages, or drive phishing attacks, thereby compromising confidentiality and integrity of the affected website’s users.

The vulnerability affects the uBidAuction application version 2.0.1. No other versions or components are explicitly listed, and the vendor product is identified simply as uBidAuction.

The CVSS score of 5.1 places the issue in the medium severity range. Because exploitation requires only a crafted GET request and a victim’s browser to follow the link, the potential attack vector is remote and does not demand user authentication. EPSS data is unavailable, but the lack of inclusion in the KEV catalog suggests no widespread public exploitation has been reported. The risk is therefore moderately high for sites that expose the posts/manage module to untrusted users or who rely on the vulnerability to persist malicious code on the front end.