Threat Intelligence Database

ClipBucket V5 version 5.5.1 contains an OS command injection vulnerability in its web installer. The vulnerability arises because the php_cli_filepath parameter is not properly validated or escaped before being passed to shell execution. This allows unauthenticated attackers to execute arbitrary commands as the web server user by submitting a crafted POST request to the installer. The vulnerability has a critical severity with a CVSS score of 9.2.

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard characters in the subtitle editing endpoint. An authenticated user can send a % character as the number parameter to overwrite all subtitle titles of any video they own in a single HTTP request. This issue has been patched in version 5.5.3 - #141.

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #133, a normal authenticated user can edit another user's video subtitles because of a lack of authorization. They can upload subtitles, edit their name or delete them. This issue has been patched in version 5.5.3 - #133.

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter to execute SQL queries and exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #129.

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly into shell commands without escaping then executed, so any shell metacharacter in the URL is interpreted. This results in arbitrary command execution. This issue has been patched in version 5.5.3 - #140.

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authenticated user who can upload videos can add multiple subtitles from different files and change their title (English, Spanish...). The POST /actions/subtitle_edit.php request used to change their title includes a number parameter which is vulnerable to SQL Injection. A boolean-based blind SQL injection can be used to exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #132.

ClipBucket v5 versions prior to 5.5.3 contain a critical SQL Injection vulnerability in the authenticated admin endpoint admin_area/action_logs.php. The vulnerability arises because the 'type' parameter from the GET request is directly concatenated into a SQL query without proper parameterization, allowing an attacker with admin privileges to perform UNION-based SQL injection and potentially exfiltrate database data. This issue is fixed in version 5.5.3.

CVE-2026-32321 is a high-severity SQL injection vulnerability affecting ClipBucket v5 versions prior to 5.5.3 #80. It exists in the actions/ajax.php endpoint due to improper sanitization of the userid parameter, allowing an authenticated attacker to perform time-based blind SQL injection. Exploitation can lead to full database disclosure and administrative account takeover without requiring user interaction. The vulnerability has a CVSS score of 8.8, reflecting its critical impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, affected users should urgently update to version 5.5.

HighVulnerabilityUnited StatesIndiaGermany+7#cve#cve-2026-32321#cwe-89

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, collection item operations are vulnerable to authorization flaws, allowing a normal authenticated user to modify another user’s collection items. This affects both add item (/actions/add_to_collection.php) due to missing authorization checks and delete item (/manage_collections.php?mode=manage_items...) due to a broken ownership check in removeItemFromCollection(). As a result, attackers can insert and remove items from collections they do not own. Version 5.5.3 #59 fixes the issue.

MediumVulnerabilityUnited StatesGermanyIndia+7#cve#cve-2026-28354#cwe-639

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, a normal authenticated user can store the XSS payload. The payload is triggered by administrator. Version 5.5.3 #59 fixes the issue.

LowVulnerabilityUnited StatesIndiaGermany+7#cve#cve-2026-26997#cwe-79