CVE-2026-96258 Details

A reflected cross-site scripting vulnerability has been identified in onSite Internet GmbH Auktion NG Auktionssoftware versions prior to 20260722. The issue resides in the Public Password Reset Endpoint, specifically within the '/forgotpasswd.html' file. The vulnerability is triggered by manipulating the 'email' parameter, allowing attackers to inject malicious content that is executed when the page is viewed. This issue can be exploited remotely.

To address this vulnerability, implement context-aware output encoding to sanitize user input before it is inserted into HTML attributes. Validate and filter the 'email' parameter to reject invalid inputs. Use secure template escaping functions provided by the framework to avoid direct concatenation of user input into HTML. Consider deploying a strict Content Security Policy to mitigate the impact of XSS vulnerabilities. Regular security audits should be conducted to identify and rectify similar output encoding issues.