ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters
Priority MEDIUM 57CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary JavaScript in victims' browsers under the application origin.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00354 29th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed clipbucket-v5 (MacWarrior): 5.5.3-#182
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MacWarrior | clipbucket-v5 | before 5.5.3-#182 | 5.5.3-#182 | Patch available | CNA |
- clipbucket-v5 VendorMacWarrior Affected before 5.5.3-#182 Fixed in 5.5.3-#182 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oxygenz:clipbucket:*:*:*:*:*:*:*:* | — | — | MacWarrior |
- cpe:2.3:a:oxygenz:clipbucket:*:*:*:*:*:*:*:* Versions — — ·MacWarrior
Remediation
- Fix · CNA clipbucket-v5 (MacWarrior) Fixed in 5.5.3-#182
Timeline
- 2026-10-02 Threatist record created from CVE-2026-95812
- 2026-10-03 Alias added: GHSA-4vrg-2v5w-7r99
References
More MacWarrior vulnerabilities
- TI-2026-32908 ClipBucket: Blind SQL Injection in progress_video.php CVSS 3.1CRITICAL 9.8
- TI-2026-31055 ClipBucket: Remote Play URL Command Injection CVSS 3.1CRITICAL 9.8
- TI-2026-17576 ClipBucket v5 Vulnerable to Blind SQL Injection through Channel Comments CVSS 3.1CRITICAL 9.8
- TI-2025-41207 ClipBucket 5.5.2 is affected by an improper access control issue where the product is… CVSS 3.1CRITICAL 9.8
- TI-2025-15584 ClipBucket V5 Playlist Cover File Upload to Remote Code Execution CVSS 3.1CRITICAL 9.8
- TI-2024-36252 Untrusted Deserialization in ClipBucket-v5 Version 5.5.1 Revision 199 and Below CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-95812 · CVE Program
- CVE-2026-95812 · NVD
- FIRST EPSS
- GHSA-4vrg-2v5w-7r99 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences