by Kastro
Paper/Archive/CVE-2026-45060

CVE-2026-45060

MacWarrior clipbucket-v5 — ClipBucket: Blind SQL Injection in progress_video.php

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 38.0.380 × 207.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter to execute SQL queries and exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #129.

Affected

ProductAffectedFixed inSource
clipbucket-v5< 5.5.3 - #129–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-wpq3-gxx7-c76h