CVE-2022-50966

uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the news/manage module. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.apphp.com/codemarket/items/48/ubidauction-php-classic-and-bid-auctions-script
https://www.exploit-db.com/exploits/50693
https://www.vulncheck.com/advisories/ubidauction-news-manage-reflected-xss
https://www.vulnerability-lab.com/get_content.php?id=2289

Configurations

No configuration.

History

20 Jul 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) uBidAuction 2.0.1 contiene una vulnerabilidad de cross-site scripting reflejada en el módulo news/manage. Los parámetros date_created, date_from, date_to y created_at en la funcionalidad de filtro no están debidamente saneados, permitiendo a atacantes remotos inyectar scripts maliciosos a través de solicitudes GET manipuladas que se ejecutan en los navegadores de las víctimas.

10 May 2026, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-10 13:16

Updated : 2026-07-20 20:10

NVD link : CVE-2022-50966

Mitre link : CVE-2022-50966

CVE.ORG link : CVE-2022-50966

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2022-50966", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-50966", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T13:16:12.205896Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "uBidAuction", "product": "uBidAuction", "versions": [{"status": "affected", "version": "2.0.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-10T13:16:34.487", "references": [{"url": "https://www.apphp.com/codemarket/items/48/ubidauction-php-classic-and-bid-auctions-script", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/50693", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/ubidauction-news-manage-reflected-xss", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulnerability-lab.com/get_content.php?id=2289", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the news/manage module. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers."}, {"lang": "es", "value": "uBidAuction 2.0.1 contiene una vulnerabilidad de cross-site scripting reflejada en el m\u00f3dulo news/manage. Los par\u00e1metros date_created, date_from, date_to y created_at en la funcionalidad de filtro no est\u00e1n debidamente saneados, permitiendo a atacantes remotos inyectar scripts maliciosos a trav\u00e9s de solicitudes GET manipuladas que se ejecutan en los navegadores de las v\u00edctimas."}], "lastModified": "2026-07-20T20:10:00.110", "sourceIdentifier": "disclosure@vulncheck.com"}