EUVD-2026-85015
GHSA-jpxq-rxwr-5478
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious /forgotpasswd.html link with email payload
-
DeliveryDeliver link to victim via phishing
-
ExploitVictim opens link in browser
-
ExecutionReflected script executes in site context
-
ImpactClient-side manipulation or content spoofing
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the public, unauthenticated password-reset endpoint /forgotpasswd.html of onSite internet GmbH Auktion NG Auktionssoftware (versions up to 20260722) by injecting script into the 'email' parameter. The key limiting factor is required user interaction (UI:P): because this is reflected - not stored - XSS, an attacker must lure a specific victim into clicking a crafted link; the payload does not persist server-side and does not fire automatically for other users. Impact is confined to low integrity (client-side manipulation in the victim's browser session) with no confidentiality or availability impact, and no authentication is needed to deliver the malicious URL. |
| Impact | This is a genuinely low-priority issue despite the medium 5.3 CVSS 4.0 score. The vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P) describes a reflected cross-site scripting flaw: network-reachable and unauthenticated, but requiring victim user interaction (UI:P) and yielding only low integrity impact (VI:L) with zero confidentiality (VC:N) and zero availability (VA:N) impact, no scope change. The SSVC/exploit-maturity signal E:P (Proof-of-Concept) is corroborated by a publicly disclosed exploit on GitHub (CSDVi/cve issue #5), so exploit code exists - but there is NO EPSS score and NO CISA KEV listing provided, so there is no evidence of automated or active real-world exploitation. Critically, this is reflected (not stored) XSS on a public password-reset page of an obscure German auction-software product, so an attacker must socially engineer a specific victim into clicking a crafted link, and the payload runs in a pre-authentication context with limited session value. The vendor was contacted but did not respond, so no patch is confirmed. Net: real exploit code exists but real-world risk is low due to required user interaction, limited impact, and tiny deployment footprint. |
| Exploit ScenarioDerived | An attacker crafts a malicious URL to /forgotpasswd.html with a JavaScript payload injected into the email parameter and delivers it to a victim (e.g., via phishing email or a link on another site). When the victim opens the link, the reflected payload executes in their browser in the context of the Auktion NG site, allowing limited DOM manipulation or client-side action. A public proof-of-concept exists (GitHub CSDVi/cve issue #5), lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Reflected cross-site scripting in the public /forgotpasswd.html password-reset endpoint of onSite internet GmbH Auktion NG Auktionssoftware (versions up to 20260722) allows remote attackers to inject script into a victim's browser by manipulating the 'email' argument. The flaw is unauthenticated to deliver but requires user interaction - a victim must be lured into opening a crafted link - because the payload is reflected rather than stored and does not fire automatically for other users. Publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV); impact is confined to low client-side integrity manipulation with no confidentiality or availability effect, making this a genuinely low-priority issue despite the medium 5.3 CVSS 4.0 score.
RemediationAI
No vendor-released patch or fixed version was identified at time of analysis - the vendor was contacted early about the disclosure and did not respond, so there is no advisory-published upgrade target to cite. Until a fix ships, the most effective control is to correct the root cause in the password-reset handler: apply context-aware HTML output encoding (or reject/escape script-bearing characters) to the 'email' value reflected by /forgotpasswd.html, which eliminates the vulnerability but requires source-code access and a custom change that must be re-applied after future vendor updates. As an interim compensating control, deploy a reverse proxy or WAF rule that blocks requests to /forgotpasswd.html containing HTML metacharacters or script patterns in the email parameter; this stops straightforward payloads but can be bypassed with encoding tricks and risks false positives on legitimate addresses. Adding a Content-Security-Policy that forbids inline script and restricts script-src to trusted origins reduces the practical impact of any successful injection in modern browsers, though it does not remove the underlying flaw and may break legitimate page scripts if not tuned. Client-side, note that the attack requires the victim to click a crafted link, so user awareness guidance and link-preview checks offer marginal value only. Given the low assessed impact (client-side integrity only, no confidentiality or availability effect), remediation can be scheduled at low priority rather than treated as an emergency.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic reflected cross-site scripting (CWE-79) in the web front end of Auktion NG, an auction platform from onSite internet GmbH, specifically the public password-reset page /forgotpasswd.html. When the application processes the 'email' form argument, it returns the supplied value in the HTML response without adequate output encoding or contextual escaping, so an attacker-supplied string containing markup or script is rendered and executed in the victim's browser within the site's origin. The endpoint is public and unauthenticated, so the malicious URL can be delivered to any user, but because the injection is reflected rather than persisted, exploitation depends on the victim clicking the crafted link (UI:P / assessed CVSS:3.1 UI:R). CPE data (cpe:2.3:a:onsite_internet_gmbh:auktion_ng_aktionssoftware:*:*:*:*:*:*:*:*) carries a wildcard version, indicating the affected range is defined by the vendor/version string 'up to 20260722' rather than a discrete release identifier. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N confirms network reachability, no privileges required, required user interaction, changed scope typical of XSS, and low integrity impact only.
Know when Auktion Ng Auktionssoftware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Reflected XSS reachable unauthenticated over the network but requiring victim interaction (UI:R); scope changes to the browser (S:C) with low confidentiality/integrity impact and no availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the component Public Password Reset Endpoint. The manipulation of the argument email leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB