Auktion Ng Auktionssoftware
Monthly
Reflected cross-site scripting in the public /forgotpasswd.html password-reset endpoint of onSite internet GmbH Auktion NG Auktionssoftware (versions up to 20260722) allows remote attackers to inject script into a victim's browser by manipulating the 'email' argument. The flaw is unauthenticated to deliver but requires user interaction - a victim must be lured into opening a crafted link - because the payload is reflected rather than stored and does not fire automatically for other users. Publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV); impact is confined to low client-side integrity manipulation with no confidentiality or availability effect, making this a genuinely low-priority issue despite the medium 5.3 CVSS 4.0 score.
Reflected cross-site scripting in the public /forgotpasswd.html password-reset endpoint of onSite internet GmbH Auktion NG Auktionssoftware (versions up to 20260722) allows remote attackers to inject script into a victim's browser by manipulating the 'email' argument. The flaw is unauthenticated to deliver but requires user interaction - a victim must be lured into opening a crafted link - because the payload is reflected rather than stored and does not fire automatically for other users. Publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV); impact is confined to low client-side integrity manipulation with no confidentiality or availability effect, making this a genuinely low-priority issue despite the medium 5.3 CVSS 4.0 score.