Macwarrior Clipbucket-V5 vulnerabilities

CVE-2026-47238 [MEDIUM] CWE-639 CVE-2026-47238: ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #133, a normal auth ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #133, a normal authenticated user can edit another user's video subtitles because of a lack of authorization. They can upload subtitles, edit their name or delete them. This issue has been patched in version 5.5.3 - #133.

CVE-2026-26005 [MEDIUM] CWE-918 CVE-2026-26005: ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #45, in Clip Bucket V5, The ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #45, in Clip Bucket V5, The Remote Play allows creating video entries that reference external video URLs without uploading the video files to the server. However, by specifying an internal network host in the video URL, an SSRF can be triggered, causing GET requests to be sent

CVE-2025-64339 [MEDIUM] CWE-79 CVE-2025-64339: ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Playlists feature is vulnerable to stored Cross-site Scripting (XSS),specifically in the Playlist Name field. An authenticated low-privileged user can create a playlist with a malicious name containing HTML/JavaScript code, which is rendered unescaped

CVE-2025-64336 [MEDIUM] CWE-79 CVE-2025-64336: ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Photos feature is vulnerable to stored Cross-site Scripting (XSS). An authenticated regular user can upload a photo with a malicious Photo Title containing HTML/JavaScript code. While the payload does not execute in the user-facing photo gallery or de

CVE-2025-62430 [MEDIUM] CWE-79 CVE-2025-62430: ClipBucket v5 is an open source video sharing platform. ClipBucket v5 through build 5.5.2 #145 allow ClipBucket v5 is an open source video sharing platform. ClipBucket v5 through build 5.5.2 #145 allows stored cross-site scripting (XSS) in multiple video and photo metadata fields. For videos the Tags field and the Genre, Actors, Producer, Executive Producer, and Director fields in Movieinfos accept user supplied values without adequate sanitization.

CVE-2026-26997 [MEDIUM] CWE-79 CVE-2026-26997: ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, a normal authent ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, a normal authenticated user can store the XSS payload. The payload is triggered by administrator. Version 5.5.3 #59 fixes the issue.

CVE-2025-62715 [MEDIUM] CWE-79 CVE-2025-62715: ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#147 and below contain a stor ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#147 and below contain a stored Cross-Site Scripting (XSS) vulnerability in ClipBucket’s Collection tags feature. An authenticated normal user can create a tag containing HTML or JavaScript, which is later rendered unescaped in collection detail and tag-list pages. As a result, ar

CVE-2026-49482 [MEDIUM] CWE-155 CVE-2026-49482: ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard characters in the subtitle editing endpoint. An authenticated user can send a % character as the number parameter to overwrite all subtitle titles of any video they own in a single HTTP request. Thi