CVE-2026-110625: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in MacWarrior clipbucket-v5
Description
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter. Attackers can send crafted flagged_item.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel origin.
CVSS v4.0
Score 5.1medium
Affected software
MacWarrior
clipbucket-v5
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-110625 is a reflected cross-site scripting vulnerability affecting ClipBucket v5 through 5.5.3-#206. The vulnerability arises from improper neutralization of input in the 'type' GET parameter of admin_area/flagged_item.php, which is not properly encoded before being used in web page generation. Attackers can exploit this by sending crafted URLs to authenticated admin or moderator users, causing injected scripts to execute in the context of the admin panel.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary scripts in the context of the admin panel for logged-in administrators or moderators. This can lead to session hijacking, unauthorized actions within the admin interface, or other malicious activities limited to the privileges of the affected user. There is no indication of privilege escalation or impact beyond the admin panel origin.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links containing the 'type' parameter in flagged_item.php. Implementing input validation and output encoding on the 'type' parameter can mitigate this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-14T13:07:28.416Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acf92f02cdf04f6568a383f
Added to database: 10/14/2026, 14:34:24 UTC
Last enriched: 10/14/2026, 14:49:41 UTC
Last updated: 10/14/2026, 20:49:11 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.