What is the CVSS score of CVE-2026-45060?

CVE-2026-45060 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of ClipBucket v5 are affected by CVE-2026-45060?

ClipBucket video platform versions prior to 5.5.3 contain a critical unauthenticated SQL injection vulnerability enabling attackers to extract entire databases without any credentials.

How to fix or mitigate CVE-2026-45060?

Within 24 hours: Inventory all ClipBucket installations and document current versions. Within 7 days: Upgrade all affected instances to ClipBucket 5.5.3 - #129 or later per vendor advisory. Within 30 days: Execute forensic audit of database transaction logs for evidence of unauthorized queries and confirm patch deployment across all environments.

ClipBucket v5 CVE-2026-45060

CRITICAL

SQL Injection (CWE-89)

2026-06-11 GitHub_M

PHP SQLi Information Disclosure Clipbucket V5

9.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Endpoint is network-reachable with no authentication or user interaction, and SQLi against the primary database yields full read, write and DoS impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 11, 2026 - 23:16 vuln.today

DescriptionCVE.org

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter to execute SQL queries and exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #129.

Articles & Coverage 1

News Critical SQL Injection in ClipBucket v5 Before 5.5.3 - CVE-2026-45060 Jun 12, 2026

AnalysisAI

Unauthenticated blind SQL injection in ClipBucket v5 prior to version 5.5.3 - #129 allows remote attackers to exfiltrate arbitrary database contents via the ids parameter of the actions/progress_video.php endpoint. The flaw carries a critical CVSS 9.8 score and no public exploit identified at time of analysis, but the trivial network-reachable attack surface on a public-facing video sharing platform makes opportunistic scanning likely. Vendor patch is available in 5.5.3 - #129 per the GHSA advisory.

Technical ContextAI

ClipBucket v5 is a PHP-based open source video sharing platform maintained by MacWarrior (CPE cpe:2.3:a:macwarrior:clipbucket-v5). The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) in the actions/progress_video.php handler, which tracks video upload/processing progress. The 'ids' parameter is concatenated into a SQL query without parameterization or sufficient input validation, enabling blind SQLi where attackers infer query results via boolean/time-based payloads against the backing MySQL/MariaDB store. Because the endpoint is reachable without authentication, no session, CSRF token, or privileged role gates access.

RemediationAI

Vendor-released patch: upgrade to ClipBucket v5 5.5.3 - #129 or later, as documented in the GHSA-wpq3-gxx7-c76h advisory at https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-wpq3-gxx7-c76h. If immediate upgrade is not feasible, block external access to /actions/progress_video.php at the reverse proxy or WAF, or add a WAF rule rejecting requests to that endpoint whose 'ids' parameter contains non-numeric characters, quotes, comments, or UNION/SLEEP/BENCHMARK tokens - note this is a stop-gap that can be bypassed by encoding tricks and may break the legitimate AJAX upload-progress UI. Additionally, rotate database credentials and any application secrets that may have been read via SQLi, and review database accounts so the ClipBucket DB user holds only the minimum privileges needed (no FILE, no cross-database SELECT).