CVE-2026-110627

ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows attackers to inject HTML via the val parameter in mode=add_todo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection, executing script in the admin panel origin.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Macwarrior Oxygenz

Products

Clipbucket-v5 Clipbucket

CVE-2026-110625

ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter. Attackers can send crafted flagged_item.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel origin.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Macwarrior Oxygenz

Products

Clipbucket-v5 Clipbucket

CVE-2026-110626

ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter. Attackers can send administrators with basic_settings permission a crafted link whose payload is echoed into a hidden input, executing script in the admin panel origin.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Macwarrior Oxygenz

Products

Clipbucket-v5 Clipbucket

CVE-2026-103766

ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter

ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries to extract user credentials and emails or modify and delete arbitrary records.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Macwarrior Oxygenz

Products

Clipbucket-v5 Clipbucket

CVE-2026-102569

ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with video_moderation permission can inject arbitrary SQL commands to extract or modify database contents.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Clip-bucket Macwarrior

Products

Clipbucket Clipbucket-v5

CVE-2026-77929

ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Upload Endpoint

ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile() function in fileupload.class.php fails to update the file extension after MIME validation, allowing an attacker-controlled .php extension to persist on disk and execute as PHP via PHP-FPM when the uploaded file is retrieved.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Macwarrior Oxygenz

Products

Clipbucket-v5 Clipbucket

CVE-2026-77928

ClipBucket < 5.5.3-#182 Blind SQL Injection via Private Message Deletion Endpoint

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitting the msg_id parameter as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php. Attackers can pass unsanitized array elements through the deletion handler in private_message.php into cb_pm::delete_msg(), which interpolates the unescaped message ID directly into a SQL query string, enabling time-based blind SQL injection to retrieve all user credential hashes and email addresses.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Macwarrior Oxygenz

Products

Clipbucket-v5 Clipbucket

CVE-2026-77927

ClipBucket < 5.5.3-#182 Blind SQL Injection via Photo Deletion Endpoint

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the check_photo parameter as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php. Attackers can pass unsanitized array elements through the bulk deletion handler in manage_photos.php to photo_exists() in photos.class.php, where non-numeric values are interpolated directly into a SQL query, enabling time-based blind SQL injection to retrieve credential hashes and other sensitive data.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Macwarrior Oxygenz

Products

Clipbucket-v5 Clipbucket

CVE-2026-102570

ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basic_settings permission can inject arbitrary SQL payloads to extract or modify database contents.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Clip-bucket Macwarrior

Products

Clipbucket Clipbucket-v5

CVE-2026-100372

ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.php

ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with manage_template_access permission can traverse outside the layout directory to modify executable PHP files and achieve remote code execution as the web server user.

CVSS 4.0 · 8.6 High EPSS 1.1% KEV · Not listed

Vendors

Clip-bucket Macwarrior

Products

Clipbucket Clipbucket-v5

CVE-2026-95812

ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters

ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary JavaScript in victims' browsers under the application origin.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Clip-bucket Macwarrior

Products

Clipbucket Clipbucket-v5

CVE-2026-47238

ClipBucket: IDOR in videos subtitle editor

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #133, a normal authenticated user can edit another user's video subtitles because of a lack of authorization. They can upload subtitles, edit their name or delete them. This issue has been patched in version 5.5.3 - #133.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Macwarrior

Products

Clipbucket-v5

CVE-2026-45418

ClipBucket: Blind SQL Injection in subtitle_edit.php

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authenticated user who can upload videos can add multiple subtitles from different files and change their title (English, Spanish...). The POST /actions/subtitle_edit.php request used to change their title includes a number parameter which is vulnerable to SQL Injection. A boolean-based blind SQL injection can be used to exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #132.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Macwarrior

Products

Clipbucket-v5

CVE-2026-49482

ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint Allows Mass Subtitle Overwrite

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard characters in the subtitle editing endpoint. An authenticated user can send a % character as the number parameter to overwrite all subtitle titles of any video they own in a single HTTP request. This issue has been patched in version 5.5.3 - #141.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Macwarrior

Products

Clipbucket-v5

CVE-2026-45060

ClipBucket: Blind SQL Injection in progress_video.php

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter to execute SQL queries and exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #129.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Macwarrior

Products

Clipbucket-v5

CVE-2026-42846

ClipBucket: Remote Play URL Command Injection

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly into shell commands without escaping then executed, so any shell metacharacter in the URL is interpreted. This results in arbitrary command execution. This issue has been patched in version 5.5.3 - #140.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Macwarrior

Products

Clipbucket-v5

CVE-2026-42847

ClipBucket: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #122, there is a critical SQL Injection (SQLi) vulnerability in ClipBucket, exploitable through the type parameter on the authenticated admin endpoint admin_area/action_logs.php. The endpoint admin_area/action_logs.php reads $_GET['type'], stores it in $result_array['type'], and forwards it into fetch_action_logs(), where the value is concatenated directly into a SQL WHERE condition on action_type without parameterization. This allows UNION-based SQL injection and direct data exfiltration from the database. This vulnerability is fixed in 5.5.3 - #122.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Macwarrior

Products

Clipbucket-v5

CVE-2026-25728

ClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race Condition

ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #40, a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability exists in ClipBucket's avatar and background image upload functionality. The application moves uploaded files to a web-accessible location before validating them, creating a window where an attacker can execute arbitrary PHP code before the file is deleted. The uploaded file was moved to a web-accessible path via move_uploaded_file(), then validated via ValidateImage(). If validation failed, the file was deleted via @unlink(). This vulnerability is fixed in 5.5.3 - #40.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Macwarrior Oxygenz

Products

Clipbucket-v5 Clipbucket

CVE-2026-26005

ClipBucket v5 enables internal network scans via an SSRF vulnerability

ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #45, in Clip Bucket V5, The Remote Play allows creating video entries that reference external video URLs without uploading the video files to the server. However, by specifying an internal network host in the video URL, an SSRF can be triggered, causing GET requests to be sent to internal servers. An attacker can exploit this to scan the internal network. Even a regular (non-privileged) user can carry out the attack.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Macwarrior Oxygenz

Products

Clipbucket-v5 Clipbucket

CVE-2026-26997

ClipBucket v5 has Stored XSS via Collection name

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, a normal authenticated user can store the XSS payload. The payload is triggered by administrator. Version 5.5.3 #59 fixes the issue.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Macwarrior Oxygenz

Products

Clipbucket-v5 Clipbucket