CVE-2026-77928
MediumCVSS 6.5Summary
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability. An authenticated user can submit the msg_id parameter as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php, then inject the unsanitized message ID into a SQL query in cb_pm::delete_msg().
Risk Assessment
An attacker can exploit time-based blind SQL injection to extract all user credential hashes and email addresses from the database, leading to full account takeover.
Recommendation
Update ClipBucket to version 5.5.3-#182 or later. Until patched, restrict access to private messaging features and monitor for unusual database queries.
Other vulnerabilities in ClipBucket
See all- CVE-2026-77929High
ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile() function fails to update the file extension after MIME validation, allowing a .php extension to persist and execute via PHP-FPM.
- CVE-2026-77927Medium
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability. An authenticated user can submit the check_photo parameter as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php, then inject unsanitized values into a SQL query in photo_exists() in photos.class.php.
- CVE-2012-6643High
Multiple SQL injection vulnerabilities in the update_counter function in includes/functions.php in ClipBucket 2.6 allow remote attackers to execute arbitrary SQL commands via the time parameter to videos.php or channels.php.
- CVE-2026-80138Critical
ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user.
- CVE-2026-42846Critical
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, the Remote Play feature allowed adding videos by importing an external URL, leading to arbitrary command execution due to improper URL handling.
- CVE-2026-21875Critical
ClipBucket v5 versions 5.5.2-#187 and below allow an attacker to perform Blind SQL Injection through the add comment section within a channel. The obj_id parameter in the POST request to /actions/ajax.php is used within the user_exists function of the upload/includes/classes/user.class.php file as the $id parameter, and then used within the count function of the upload/includes/classes/db.class.php file. The $id parameter is concatenated into the query without validation or sanitization, and user-supplied input like 1' or 1=1-- - can trigger the injection. This issue does not have a fix at the time of publication.
- CVE-2025-67418Critical
ClipBucket 5.5.2 is shipped with hardcoded default administrative credentials. An unauthenticated remote attacker can log in to the admin panel, gaining full administrative control of the application.
- CVE-2026-49482Medium
ClipBucket v5 is an open source video sharing platform that prior to version 5.5.3 - #141 contained improper neutralization of SQL wildcard characters in the subtitle editing endpoint. An authenticated user could send a % character as the number parameter to overwrite all subtitle titles of any video they own in a single HTTP request.
- CVE-2026-47238Medium
ClipBucket v5 is an open source video sharing platform. In versions prior to 5.5.3 - #133, a normal authenticated user could edit another user's video subtitles due to a lack of authorization.
- CVE-2026-45418High
ClipBucket v5 is an open source video sharing platform that prior to version 5.5.3 - #132 had a vulnerability allowing authenticated users to add multiple subtitles from different files and change their titles. The POST /actions/subtitle_edit.php request used to change titles includes a number parameter that is vulnerable to SQL Injection.
Original NVD description (English source)
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitting the msg_id parameter as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php. Attackers can pass unsanitized array elements through the deletion handler in private_message.php into cb_pm::delete_msg(), which interpolates the unescaped message ID directly into a SQL query string, enabling time-based blind SQL injection to retrieve all user credential hashes and email addresses.