Description
A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the component Public Password Reset Endpoint. The manipulation of the argument email leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-23
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting via the public password reset endpoint
Action: Apply patch
AI Analysis

Impact

A cross‑site scripting vulnerability exists in the public password reset endpoint of onSite internet GmbH Auktion NG Auktionssoftware. By manipulating the email parameter in the /forgotpasswd.html page, an attacker can inject arbitrary JavaScript that executes in the victim’s browser. This allows the attacker to steal session cookies, deface the page, or perform further malicious actions. The CVSS score of 5.3 indicates moderate impact, affecting confidentiality, integrity, and availability for users interacting with the affected page.

Affected Systems

The vulnerability is present in all releases of onSite internet GmbH Auktion NG Auktionssoftware up to and including the 20260722 build. Users running any version equal to or older than this build are affected.

Risk and Exploitability

The flaw can be exploited remotely by sending a crafted request to /forgotpasswd.html; no authentication is required. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting that there is currently no widespread active exploitation. Nonetheless, the potential for phishing or credential theft makes it a serious issue for exposed installations.

Generated by OpenCVE AI on September 23, 2026 at 04:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a patched version released after 20260722 or apply vendor‑supplied fix if available.
  • Sanitize the email input and perform output encoding on the forgotpasswd.html page to block script injection.
  • Deploy a content‑security‑policy that blocks inline scripts and enable X‑SSRF/X‑XSS‑Protection headers to mitigate remaining risks.

Generated by OpenCVE AI on September 23, 2026 at 04:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 26 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 03:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the component Public Password Reset Endpoint. The manipulation of the argument email leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title onSite internet GmbH Auktion NG Auktionssoftware Public Password Reset Endpoint forgotpasswd.html cross site scripting
First Time appeared Onsite Internet Gmbh
Onsite Internet Gmbh auktion Ng Auktionssoftware
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:onsite_internet_gmbh:auktion_ng_auktionssoftware:*:*:*:*:*:*:*:*
Vendors & Products Onsite Internet Gmbh
Onsite Internet Gmbh auktion Ng Auktionssoftware
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Onsite Internet Gmbh Auktion Ng Auktionssoftware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-26T00:19:14.601Z

Reserved: 2026-09-22T19:57:29.305Z

Link: CVE-2026-96258

cve-icon Vulnrichment

Updated: 2026-09-26T00:19:10.687Z

cve-icon NVD

Status : Deferred

Published: 2026-09-23T04:17:58.613

Modified: 2026-09-26T01:17:03.527

Link: CVE-2026-96258

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T09:10:59Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')