CVE-2022-50969

uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the backend/mailingLog/manage module. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.apphp.com/codemarket/items/48/ubidauction-php-classic-and-bid-auctions-script
https://www.exploit-db.com/exploits/50693
https://www.vulncheck.com/advisories/ubidauction-mailinglog-manage-reflected-xss
https://www.vulnerability-lab.com/get_content.php?id=2289

Configurations

No configuration.

History

24 Jul 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) uBidAuction 2.0.1 contiene una vulnerabilidad de cross-site scripting reflejado en el módulo backend/mailingLog/manage. Los parámetros date_created, date_from, date_to y created_at en la funcionalidad de filtro no se sanean correctamente, permitiendo a atacantes remotos inyectar scripts maliciosos a través de solicitudes GET manipuladas que se ejecutan en los navegadores de las víctimas.

10 May 2026, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-10 13:16

Updated : 2026-07-25 10:10

NVD link : CVE-2022-50969

Mitre link : CVE-2022-50969

CVE.ORG link : CVE-2022-50969

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2022-50969", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-50969", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T02:36:35.783427Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "uBidAuction", "product": "uBidAuction", "versions": [{"status": "affected", "version": "2.0.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-10T13:16:34.867", "references": [{"url": "https://www.apphp.com/codemarket/items/48/ubidauction-php-classic-and-bid-auctions-script", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/50693", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/ubidauction-mailinglog-manage-reflected-xss", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulnerability-lab.com/get_content.php?id=2289", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the backend/mailingLog/manage module. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers."}, {"lang": "es", "value": "uBidAuction 2.0.1 contiene una vulnerabilidad de cross-site scripting reflejado en el m\u00f3dulo backend/mailingLog/manage. Los par\u00e1metros date_created, date_from, date_to y created_at en la funcionalidad de filtro no se sanean correctamente, permitiendo a atacantes remotos inyectar scripts maliciosos a trav\u00e9s de solicitudes GET manipuladas que se ejecutan en los navegadores de las v\u00edctimas."}], "lastModified": "2026-07-25T10:10:00.167", "sourceIdentifier": "disclosure@vulncheck.com"}