Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.1
CVE-2022-50964: uBidAuction 2.0.1: Malicious scripts can be injected via auction filters.
CVE-2022-50964 · published 5 months ago
Summary
A security issue in uBidAuction 2.0.1 allows attackers to inject malicious code into users' browsers when they filter auctions. This could potentially steal sensitive information or take control of users' accounts. Update to the latest version of uBidAuction to fix this issue.
Original advisory text
uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/myAuctions/status/loose module. The date_created, date_from, date_to, and created_at parameters in the filt...
uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/myAuctions/status/loose module. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published10 May 2026
Updated4 Nov 2026
First seen10 May 2026
Sources
CVE-2022-50964 · NVD
Track software like this
Free during beta