Vulnerabilities

TI-2026-74121 CVE-2026-110627 · GHSA-cgvx-3fjx-9r52

Reflected cross-site scripting in ClipBucket v5 admin panel

MEDIUM 44

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows attackers to inject HTML via the val parameter in mode=add_todo.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00357 Published 2026-10-14 No fix listed CWE-79

TI-2026-74120 CVE-2026-110626 · GHSA-fg76-hwrp-jc9q

Reflected cross-site scripting in ClipBucket v5 language settings

MEDIUM 56

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00393 Published 2026-10-14 No fix listed CWE-79

TI-2026-74119 CVE-2026-110625 · GHSA-53c3-hqvh-688h

Reflected cross-site scripting in ClipBucket admin flagged items page

MEDIUM 56

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00393 Published 2026-10-14 No fix listed CWE-79

TI-2026-65762 CVE-2026-103766 · GHSA-29w7-pp39-xf4w

ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter

HIGH 72

ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00456 Published 2026-10-01 No fix listed CWE-89

TI-2026-65430 CVE-2026-102570 · GHSA-p9pr-jwvj-678g

ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter

MEDIUM 64

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is concatenated unescaped into the WHERE clause of an UPDATE statem…

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.00289 Published 2026-09-29 No fix listed CWE-89

TI-2026-65429 CVE-2026-102569 · GHSA-cv8f-6qcw-63fp

ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter

MEDIUM 64

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping.

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.00289 Published 2026-09-29 No fix listed CWE-89

TI-2026-64650 CVE-2026-100372 · GHSA-5vrm-rpx8-j2p7

ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.php

HIGH 72

ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folde…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01142 Published 2026-09-25 Fixed in 5.5.3-#197 CWE-22

TI-2026-63742 CVE-2026-96272 · GHSA-x2pv-2g6c-6vc3

ClipBucket v5 before 5.5.3-#182 SQL Injection via search_result.php

HIGH 77

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00416 Published 2026-09-23 Fixed in 5.5.3-#182 CWE-89

TI-2026-63692 CVE-2026-95812 · GHSA-4vrg-2v5w-7r99

ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters

MEDIUM 57

ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time query parameters.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00354 Published 2026-09-22 Fixed in 5.5.3-#182 CWE-79

TI-2026-54246 CVE-2026-77929 · GHSA-g885-94pf-hc9v

ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Upload Endpoint

MEDIUM 41

ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00941 Published 2026-09-18 Fixed in 5.5.3-#182 CWE-434

TI-2026-54245 CVE-2026-77928 · GHSA-wwv3-r4qp-89fg

ClipBucket < 5.5.3-#182 Blind SQL Injection via Private Message Deletion Endpoint

LOW 32

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitting the msg_id parameter as an array to bypass the clean_reque…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00424 Published 2026-09-18 Fixed in 5.5.3-#182 CWE-89

TI-2026-54244 CVE-2026-77927 · GHSA-cxg4-4mfc-283v

ClipBucket < 5.5.3-#182 Blind SQL Injection via Photo Deletion Endpoint

LOW 32

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the check_photo parameter as an array to bypass the c…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00424 Published 2026-09-18 Fixed in 5.5.3-#182 CWE-89

TI-2026-55391 CVE-2026-80138 · GHSA-h7wf-mrfw-7fxq

ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter

MEDIUM 50

ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01197 Published 2026-08-25 No fix listed CWE-78

TI-2026-36634 CVE-2026-49482