Threats affecting pkg:github/macwarrior/clipbucket-v5

ClipBucket v5 through 5.5.3-#206 has a reflected cross-site scripting (XSS) vulnerability in the admin_area/index.php file. This flaw allows attackers to inject malicious HTML via the val parameter when mode=add_todo is used. An attacker can trick a logged-in administrator into submitting a cross-site POST form that lacks CSRF protection, leading to script execution within the admin panel context. The vulnerability has a low CVSS score of 2.1 and does not appear to have known exploits in the wild.

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting (XSS) vulnerability in the admin_area/language_settings.php file. The vulnerability arises from the unencoded edit_language GET parameter, allowing attackers to craft links that execute scripts in the admin panel context when visited by administrators with basic_settings permission.

ClipBucket v5 through 5.5.3-#206 has a reflected cross-site scripting (XSS) vulnerability in the admin panel. The flaw exists in the admin_area/flagged_item.php script via the unencoded 'type' GET parameter. This allows attackers to craft malicious links that, when visited by logged-in administrators or moderators, execute injected scripts in the context of the admin panel origin.

ClipBucket v5 through version 5.5.3-#197 contains a high-severity SQL injection vulnerability. Authenticated users with ad_manager_access permission can exploit this flaw by injecting SQL commands via the delete parameter in the ads_manager.php admin interface. This allows attackers to perform time-based blind SQL injection attacks to extract sensitive data such as user credentials and emails or to modify and delete arbitrary database records.

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function. This flaw allows an authenticated administrator with basic_settings permission to inject arbitrary SQL commands via the language_id parameter, which is not properly escaped in an UPDATE statement's WHERE clause. The vulnerability can be exploited to extract or modify database contents.

ClipBucket v5 through 5.5.3-#197 has a time-based blind SQL injection vulnerability in its admin video edit function. This flaw allows an authenticated administrator with video_moderation permission to inject arbitrary SQL commands via the videoid parameter, which is improperly escaped in an UPDATE statement.

ClipBucket v5 before version 5.5.3-#197 has a path traversal vulnerability in its admin template editor. Authenticated administrators with manage_template_access permission can exploit this flaw by supplying directory traversal sequences in the folder parameter. This allows them to overwrite PHP files outside the intended layout directory, potentially leading to remote code execution as the web server user.

ClipBucket v5 before 5.5.3-#182 has a blind SQL injection vulnerability in its photo search endpoint. The vulnerability arises because a query parameter is unsanitized and used directly in SQL WHERE and ORDER BY clauses. This allows unauthenticated attackers to perform time-based blind SQL injection attacks to extract sensitive information such as user credentials, email addresses, and administrator password hashes, potentially leading to account takeover.

ClipBucket v5 before 5.5.3-#182 has a reflected cross-site scripting (XSS) vulnerability in the sort_link() helper function. This flaw occurs because the cat, sort, and time query parameters are not properly sanitized, allowing attackers to inject malicious JavaScript payloads. Successful exploitation could lead to arbitrary script execution in users' browsers within the context of the affected application.

ClipBucket v5 before 5.5.3-#182 has a file upload vulnerability that allows authenticated users to upload PHP files disguised as images. This leads to remote code execution because the file extension is not properly updated after MIME validation, allowing PHP code execution via PHP-FPM.

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitting the msg_id parameter as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php. Attackers can pass unsanitized array elements through the deletion handler in private_message.php into cb_pm::delete_msg(), which interpolates the unescaped message ID directly into a SQL query string, enabling time-based blind SQL injection to retrieve all user credential hashes and email addresses.

ClipBucket v5 before 5.5.3-#182 has a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database data. The flaw arises from improper sanitization of the check_photo parameter when submitted as an array, bypassing the clean_requests() function. Unsanitized inputs reach SQL queries in photos.class.php, enabling time-based blind SQL injection attacks to retrieve sensitive information such as credential hashes.

ClipBucket V5 version 5.5.1 contains an OS command injection vulnerability in its web installer. The vulnerability arises because the php_cli_filepath parameter is not properly validated or escaped before being passed to shell execution. This allows unauthenticated attackers to execute arbitrary commands as the web server user by submitting a crafted POST request to the installer. The vulnerability has a critical severity with a CVSS score of 9.2.

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard characters in the subtitle editing endpoint. An authenticated user can send a % character as the number parameter to overwrite all subtitle titles of any video they own in a single HTTP request. This issue has been patched in version 5.5.3 - #141.

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #133, a normal authenticated user can edit another user's video subtitles because of a lack of authorization. They can upload subtitles, edit their name or delete them. This issue has been patched in version 5.5.3 - #133.

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter to execute SQL queries and exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #129.

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly into shell commands without escaping then executed, so any shell metacharacter in the URL is interpreted. This results in arbitrary command execution. This issue has been patched in version 5.5.3 - #140.

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authenticated user who can upload videos can add multiple subtitles from different files and change their title (English, Spanish...). The POST /actions/subtitle_edit.php request used to change their title includes a number parameter which is vulnerable to SQL Injection. A boolean-based blind SQL injection can be used to exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #132.

ClipBucket v5 versions prior to 5.5.3 contain a critical SQL Injection vulnerability in the authenticated admin endpoint admin_area/action_logs.php. The vulnerability arises because the 'type' parameter from the GET request is directly concatenated into a SQL query without proper parameterization, allowing an attacker with admin privileges to perform UNION-based SQL injection and potentially exfiltrate database data. This issue is fixed in version 5.5.3.

CVE-2026-32321 is a high-severity SQL injection vulnerability affecting ClipBucket v5 versions prior to 5.5.3 #80. It exists in the actions/ajax.php endpoint due to improper sanitization of the userid parameter, allowing an authenticated attacker to perform time-based blind SQL injection. Exploitation can lead to full database disclosure and administrative account takeover without requiring user interaction. The vulnerability has a CVSS score of 8.8, reflecting its critical impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, affected users should urgently update to version 5.5.