| Название | onSite internet GmbH Auktion:NG Auktionssoftware Unknown Cross Site Scripting |
|---|
| Описание | A reflected Cross-Site Scripting vulnerability was identified in the Auktion:NG Auktionssoftware deployment at auction.venta24.de. The issue affects the public password reset endpoint /forgotpasswd.html and is triggered through the email parameter. When form validation fails, the submitted email value is reflected into the value attribute of an HTML input field without proper context-aware encoding. By injecting a double quote, an attacker can break out of the attribute and add attacker-controlled attributes, such as JavaScript event handlers.
The vulnerability does not require authentication and was confirmed in the validation error path using an intentionally invalid CAPTCHA value, so no password reset was completed. Successful exploitation could allow JavaScript execution in a victim's browser under the trusted auction.venta24.de origin, enabling phishing, UI manipulation, access to non-HttpOnly page data, or same-origin actions with the victim's active session. The exact Auktion:NG product version was not disclosed by the tested public pages or HTTP responses; the issue was confirmed on the public production deployment on 2026-07-22. |
|---|
| Источник | ⚠️ https://github.com/CSDVi/cve/issues/5 |
|---|
| Пользователь | david_12 (UID 99465) |
|---|
| Представление | 22.07.2026 09:20 (2 месяцы назад) |
|---|
| Модерация | 22.09.2026 21:57 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 408708 [onSite internet GmbH Auktion NG Auktionssoftware до 20260722 Public Password Reset Endpoint /forgotpasswd.html email межсайтовый скриптинг] |
|---|
| Баллы | 20 |
|---|