uBidAuction 2.0.1 contains a reflected cross‑site scripting flaw in the backend/mailingLog/manage module. The date_created, date_from, date_to and created_at parameters in the filtering form are not properly sanitized, allowing an attacker to inject arbitrary JavaScript through a crafted GET request. When a victim visits the resulting URL, the injected script executes in the context of the site, potentially enabling session hijacking, phishing or defacement. This vulnerability corresponds to CWE‑79.

The affected product is uBidAuction, version 2.0.1. The vulnerability is present in the backend/mailingLog/manage module of the application.

The vulnerability has a CVSS score of 5.1, which indicates a moderate severity. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by directing a victim to a maliciously crafted URL that contains the unsanitized parameters. Successful exploitation would result in arbitrary script execution within the victim’s browser, compromising confidentiality, integrity and potentially availability of the application.