The uBidAuction 2.0.1 application contains a reflected cross‑site scripting vulnerability in the auctions/manage module. The date_created, date_from, date_to, and created_at parameters used in the filter functionality are not properly sanitized, allowing malicious scripts to be injected via crafted GET requests that are then executed in the victim’s browser when the URL is visited.

This issue affects the uBidAuction application, specifically version 2.0.1. Users running this unpatched version or any installations that expose the auctions/manage module are vulnerable.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker delivering a crafted GET request that includes malicious JavaScript to a victim, who then views the URL and has the script executed in the context of the site.