A reflected cross‑site scripting flaw exists in uBidAuction’s tickets/manage module. Parameters used by the filter interface – date_created, date_from, date_to and created_at – are not sanitized, enabling an attacker to embed JavaScript via crafted GET requests. When a victim clicks the malicious link, the script runs in their browser, potentially stealing credentials or performing phishing attacks.

Vendor uBidAuction, product uBidAuction 2.0.1. The vulnerability affects installations of this exact version that have the tickets/manage module enabled. No other versions or vendors are listed.

The flaw carries a CVSS score of 5.1, indicating moderate impact. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting it has not yet been widely exploited. Attackers would rely on social engineering to persuade a victim to open the crafted URL, so exploitation is limited to contexts where users visit attacker‑controlled links. However, once executed the script could perform session hijacking or other client‑side attacks.