CVE-2026-45418
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
ClipBucket v5 is an open source video sharing platform that prior to version 5.5.3 - #132 had a vulnerability allowing authenticated users to add multiple subtitles from different files and change their titles. The POST /actions/subtitle_edit.php request used to change titles includes a number parameter that is vulnerable to SQL Injection.
Risk Assessment
An attacker can exploit this vulnerability to perform a boolean-based blind SQL injection attack, potentially leading to the exfiltration of sensitive data. This poses a serious risk to user data security.
Recommendation
It is recommended to upgrade to version 5.5.3 - #132 to mitigate this vulnerability. Additionally, conducting a security audit of the application to identify other potential vulnerabilities is advisable.
Other vulnerabilities in ClipBucket v5
See all- CVE-2012-6643High
Multiple SQL injection vulnerabilities in the update_counter function in includes/functions.php in ClipBucket 2.6 allow remote attackers to execute arbitrary SQL commands via the time parameter to videos.php or channels.php.
- CVE-2026-80138Critical
ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user.
- CVE-2026-42846Critical
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, the Remote Play feature allowed adding videos by importing an external URL, leading to arbitrary command execution due to improper URL handling.
- CVE-2026-21875Critical
ClipBucket v5 versions 5.5.2-#187 and below allow an attacker to perform Blind SQL Injection through the add comment section within a channel. The obj_id parameter in the POST request to /actions/ajax.php is used within the user_exists function of the upload/includes/classes/user.class.php file as the $id parameter, and then used within the count function of the upload/includes/classes/db.class.php file. The $id parameter is concatenated into the query without validation or sanitization, and user-supplied input like 1' or 1=1-- - can trigger the injection. This issue does not have a fix at the time of publication.
- CVE-2025-67418Critical
ClipBucket 5.5.2 is shipped with hardcoded default administrative credentials. An unauthenticated remote attacker can log in to the admin panel, gaining full administrative control of the application.
- CVE-2026-49482Medium
ClipBucket v5 is an open source video sharing platform that prior to version 5.5.3 - #141 contained improper neutralization of SQL wildcard characters in the subtitle editing endpoint. An authenticated user could send a % character as the number parameter to overwrite all subtitle titles of any video they own in a single HTTP request.
- CVE-2026-47238Medium
ClipBucket v5 is an open source video sharing platform. In versions prior to 5.5.3 - #133, a normal authenticated user could edit another user's video subtitles due to a lack of authorization.
- CVE-2026-37470High
Vulnerability in ClipBucket v5.5.2 allows remote attacker to execute arbitrary code via the authentication interface, login page, and HTTP response security headers.
Original NVD description (English source)
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authenticated user who can upload videos can add multiple subtitles from different files and change their title (English, Spanish...). The POST /actions/subtitle_edit.php request used to change their title includes a number parameter which is vulnerable to SQL Injection. A boolean-based blind SQL injection can be used to exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #132.