TI-2026-74119 Aliases CVE-2026-110625 GHSA-53c3-hqvh-688h

Reflected cross-site scripting in ClipBucket admin flagged items page

MEDIUM 56CWE-79Published 2026-10-14 · Updated 2026-10-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting flaw in admin_area/flagged_item.php. The unencoded type GET parameter lets crafted links inject script into the page (CWE-79). A remote attacker needs no privileges, but a logged-in administrator or moderator must open the link, and the script then runs in the admin panel origin. CISA SSVC rates exploitation as proof of concept.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter. Attackers can send crafted flagged_item.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel origin.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00393 33rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MacWarrior	clipbucket-v5	up to 5.5.3-#206	—	No fix listed	CNA

clipbucket-v5 VendorMacWarrior Affected up to 5.5.3-#206 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:oxygenz:clipbucket::::::::	—	—	MacWarrior

cpe:2.3:a:oxygenz:clipbucket:*:*:*:*:*:*:*:* Versions — — ·MacWarrior

Remediation

The sources list no fixed version for ClipBucket v5.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-14 Threatist record created from CVE-2026-110625
2026-10-14 Alias added: GHSA-53c3-hqvh-688h
2026-10-15 CISA SSVC decision points changed
2026-10-15 Priority changed: LOW → MEDIUM

References

Patch 1

Proposed fix (PR #936, unmerged at time of assignment)

Advisory 1

https://hackmd.io/@leediay/BJR_lh2ifg

Other 3

TI-2026-32908 ClipBucket: Blind SQL Injection in progress_video.php CVSS 3.1CRITICAL 9.8
TI-2026-31055 ClipBucket: Remote Play URL Command Injection CVSS 3.1CRITICAL 9.8
TI-2026-17576 ClipBucket v5 Vulnerable to Blind SQL Injection through Channel Comments CVSS 3.1CRITICAL 9.8
TI-2025-41207 ClipBucket 5.5.2 is affected by an improper access control issue where the product is… CVSS 3.1CRITICAL 9.8
TI-2025-15584 ClipBucket V5 Playlist Cover File Upload to Remote Code Execution CVSS 3.1CRITICAL 9.8
TI-2024-36252 Untrusted Deserialization in ClipBucket-v5 Version 5.5.1 Revision 199 and Below CVSS 3.1CRITICAL 9.8

See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences