CVE-2026-96272: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in MacWarrior clipbucket-v5
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials, email addresses, and administrator password hashes for account takeover.
AI Analysis
Technical Summary
CVE-2026-96272 describes a blind SQL injection vulnerability in ClipBucket v5 prior to version 5.5.3-#182. The flaw exists in the photo search endpoint where the query parameter is directly incorporated into SQL WHERE and ORDER BY clauses without proper sanitization. This enables unauthenticated attackers to exploit time-based blind SQL injection techniques to retrieve sensitive information including user credentials, email addresses, and administrator password hashes.
Potential Impact
An attacker can exploit this vulnerability without authentication to extract sensitive user data and administrator password hashes. This can lead to account takeover and unauthorized access to the system. The vulnerability has a high severity score (CVSS 8.7) indicating significant risk if exploited.
Mitigation Recommendations
A fix is available in ClipBucket v5.5.3-#182 and later versions. Users should upgrade to version 5.5.3-#182 or newer to remediate this vulnerability. No other mitigation guidance is provided in the input data.
CVE-2026-96272: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in MacWarrior clipbucket-v5
Description
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials, email addresses, and administrator password hashes for account takeover.
CVSS v4.0
Score 8.7high
Affected software
MacWarrior
clipbucket-v5
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-96272 describes a blind SQL injection vulnerability in ClipBucket v5 prior to version 5.5.3-#182. The flaw exists in the photo search endpoint where the query parameter is directly incorporated into SQL WHERE and ORDER BY clauses without proper sanitization. This enables unauthenticated attackers to exploit time-based blind SQL injection techniques to retrieve sensitive information including user credentials, email addresses, and administrator password hashes.
Potential Impact
An attacker can exploit this vulnerability without authentication to extract sensitive user data and administrator password hashes. This can lead to account takeover and unauthorized access to the system. The vulnerability has a high severity score (CVSS 8.7) indicating significant risk if exploited.
Mitigation Recommendations
A fix is available in ClipBucket v5.5.3-#182 and later versions. Users should upgrade to version 5.5.3-#182 or newer to remediate this vulnerability. No other mitigation guidance is provided in the input data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-22T20:36:08.209Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab32561f7a7c54106128d07
Added to database: 09/23/2026, 01:03:29 UTC
Last enriched: 09/23/2026, 01:17:37 UTC
Last updated: 09/23/2026, 01:58:06 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.