CVE-2022-50966

MediumCVSS 6.1/10Last modified Jul 20, 2026

Description

uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the news/manage module. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 10, 2026
Last modified: Jul 20, 2026
NVD status: Deferred

Related CVEs from 2022

CVE-2022-509676.1uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the tickets/manage module. The date_created, date_from, date_to CVE-2022-509686.1uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/manage module. The date_created, date_from, date_t CVE-2022-509696.1uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the backend/mailingLog/manage module. The date_created, date_fr CVE-2022-509705.4WordPress Plugin AAWP 3.16 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious s CVE-2022-509717.8Malwarebytes 4.5 contains an unquoted service path vulnerability in the MBAMService executable that allows local attackers to escalate privi CVE-2022-509729.8WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell comm CVE-2022-509739.8Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unaut CVE-2022-509758.8An unauthenticated remote attacker is able to use an existing session id of a logged in user and gain full access to the device if configura CVE-2022-509767.7A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB.CVE-2022-509777.5An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via HTTP.CVE-2022-509787.5An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (TCP)CVE-2022-509796.5An unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (RS