CVE-2026-110627: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in MacWarrior clipbucket-v5

CVE-2026-110627 describes a reflected cross-site scripting vulnerability in ClipBucket v5 up to version 5.5.3-#206. The vulnerability exists in the admin_area/index.php file where the 'val' parameter in the mode=add_todo functionality is not properly neutralized, allowing injection of arbitrary HTML/JavaScript. Exploitation requires social engineering to induce an authenticated administrator to submit a crafted cross-site POST request without CSRF protection, leading to script execution in the admin panel's origin.

Successful exploitation can lead to execution of attacker-controlled scripts in the context of the administrator's browser session within the admin panel. This may allow actions such as session hijacking or unauthorized administrative operations. However, the vulnerability requires user interaction (administrator submitting a malicious form) and has a low CVSS score of 2.1, indicating limited impact and exploitability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious of unsolicited requests and avoid submitting untrusted forms. Implementing CSRF protections and input validation on the 'val' parameter is recommended once a vendor update is released.