Macwarrior Clipbucket-V5 vulnerabilities

CVE-2026-77927 [MEDIUM] CWE-89 CVE-2026-77927: ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticat ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the check_photo parameter as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php. Attackers can pass unsanitized array elements through the bulk deleti

CVE-2025-21623 [HIGH] CWE-22 CVE-2025-21623: ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 238, ClipBucket V5 allow ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 238, ClipBucket V5 allows unauthenticated attackers to change the template directory via a directory traversal, which results in a denial of service.

CVE-2025-64114 [MEDIUM] CWE-89 CVE-2025-64114: ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - #151 and below allow authen ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - #151 and below allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database through its ClipBucket Custom Fields plugin. The vulnerabilities require the Custom Fields plugin to be installed and accessible, and can on

CVE-2026-28354 [MEDIUM] CWE-639 CVE-2026-28354: ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, collection item ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, collection item operations are vulnerable to authorization flaws, allowing a normal authenticated user to modify another user’s collection items. This affects both add item (/actions/add_to_collection.php) due to missing authorization checks and delete item (/manage_c

CVE-2026-102570 [MEDIUM] CWE-89 CVE-2026-102570: ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the lang ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basic_settings permission can inject arbitrary SQL payloads to extract or modify database

CVE-2025-62423 [HIGH] CWE-89 CVE-2025-62423: ClipBucket V5 provides open source video hosting with PHP. In version5.5.2 - #140 and earlier, a Bli ClipBucket V5 provides open source video hosting with PHP. In version5.5.2 - #140 and earlier, a Blind SQL injection vulnerability exists in the Admin Area’s “/admin_area/login_as_user.php” file. Exploiting this vulnerability requires access privileges to the Admin Area.

CVE-2025-62424 [MEDIUM] CWE-22 CVE-2025-62424: ClipBucket is a web-based video-sharing platform. In ClipBucket version 5.5.2 - #146 and earlier, th ClipBucket is a web-based video-sharing platform. In ClipBucket version 5.5.2 - #146 and earlier, the /admin_area/template_editor.php endpoint is vulnerable to path traversal. The validation of the file-loading path is inadequate, allowing authenticated administrators to read and write arbitrary files outside the intended template directory by insert

CVE-2026-102569 [MEDIUM] CWE-89 CVE-2026-102569: ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admi ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with video_moderation permission can inject arbitrary SQL commands to extract or modify database conten

CVE-2025-65113 [MEDIUM] CWE-770 CVE-2025-65113: ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 - #164, an authorizat ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 - #164, an authorization bypass vulnerability in the AJAX flagging system allows any unauthenticated user to flag any content (users, videos, photos, collections) on the platform. This can lead to mass flagging attacks, content disruption, and moderation system abuse. Thi

CVE-2026-47238 [MEDIUM] CWE-639 CVE-2026-47238: ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #133, a normal auth ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #133, a normal authenticated user can edit another user's video subtitles because of a lack of authorization. They can upload subtitles, edit their name or delete them. This issue has been patched in version 5.5.3 - #133.

CVE-2026-26005 [MEDIUM] CWE-918 CVE-2026-26005: ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #45, in Clip Bucket V5, The ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #45, in Clip Bucket V5, The Remote Play allows creating video entries that reference external video URLs without uploading the video files to the server. However, by specifying an internal network host in the video URL, an SSRF can be triggered, causing GET requests to be sent

CVE-2025-64336 [MEDIUM] CWE-79 CVE-2025-64336: ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Photos feature is vulnerable to stored Cross-site Scripting (XSS). An authenticated regular user can upload a photo with a malicious Photo Title containing HTML/JavaScript code. While the payload does not execute in the user-facing photo gallery or de

CVE-2026-26997 [MEDIUM] CWE-79 CVE-2026-26997: ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, a normal authent ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, a normal authenticated user can store the XSS payload. The payload is triggered by administrator. Version 5.5.3 #59 fixes the issue.

CVE-2025-64339 [MEDIUM] CWE-79 CVE-2025-64339: ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Playlists feature is vulnerable to stored Cross-site Scripting (XSS),specifically in the Playlist Name field. An authenticated low-privileged user can create a playlist with a malicious name containing HTML/JavaScript code, which is rendered unescaped

CVE-2026-95812 [MEDIUM] CWE-79 CVE-2026-95812: ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_ ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary JavaScript in victims' browsers under the application orig

CVE-2025-62430 [MEDIUM] CWE-79 CVE-2025-62430: ClipBucket v5 is an open source video sharing platform. ClipBucket v5 through build 5.5.2 #145 allow ClipBucket v5 is an open source video sharing platform. ClipBucket v5 through build 5.5.2 #145 allows stored cross-site scripting (XSS) in multiple video and photo metadata fields. For videos the Tags field and the Genre, Actors, Producer, Executive Producer, and Director fields in Movieinfos accept user supplied values without adequate sanitization.

CVE-2025-62715 [MEDIUM] CWE-79 CVE-2025-62715: ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#147 and below contain a stor ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#147 and below contain a stored Cross-Site Scripting (XSS) vulnerability in ClipBucket’s Collection tags feature. An authenticated normal user can create a tag containing HTML or JavaScript, which is later rendered unescaped in collection detail and tag-list pages. As a result, ar

CVE-2026-49482 [MEDIUM] CWE-155 CVE-2026-49482: ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard characters in the subtitle editing endpoint. An authenticated user can send a % character as the number parameter to overwrite all subtitle titles of any video they own in a single HTTP request. Thi