| शीर्षक | onSite internet GmbH Auktion:NG Auktionssoftware Unknown Cross Site Scripting |
|---|
| विवरण | A reflected Cross-Site Scripting vulnerability was identified in the Auktion:NG Auktionssoftware deployment at auction.venta24.de. The issue affects the public password reset endpoint /forgotpasswd.html and is triggered through the email parameter. When form validation fails, the submitted email value is reflected into the value attribute of an HTML input field without proper context-aware encoding. By injecting a double quote, an attacker can break out of the attribute and add attacker-controlled attributes, such as JavaScript event handlers.
The vulnerability does not require authentication and was confirmed in the validation error path using an intentionally invalid CAPTCHA value, so no password reset was completed. Successful exploitation could allow JavaScript execution in a victim's browser under the trusted auction.venta24.de origin, enabling phishing, UI manipulation, access to non-HttpOnly page data, or same-origin actions with the victim's active session. The exact Auktion:NG product version was not disclosed by the tested public pages or HTTP responses; the issue was confirmed on the public production deployment on 2026-07-22. |
|---|
| स्रोत | ⚠️ https://github.com/CSDVi/cve/issues/5 |
|---|
| उपयोगकर्ता | david_12 (UID 99465) |
|---|
| सबमिशन | 22/07/2026 09:20 AM (2 महीनों पहले) |
|---|
| संयम | 22/09/2026 09:57 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 408708 [onSite internet GmbH Auktion NG Auktionssoftware तक 20260722 Public Password Reset Endpoint /forgotpasswd.html email क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|