CVE-2022-50968: Ubidauction

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/manage module. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.

Affected products

• Ubidauction Ubidauction: version 2.0.1 only

Published 2026-05-10. Last modified 2026-07-25.