What is the CVSS score of CVE-2026-49482?

CVE-2026-49482 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

ClipBucket v5 CVE-2026-49482

MEDIUM

Improper Neutralization of Wildcards or Matching Symbols (CWE-155)

2026-06-11 GitHub_M

Information Disclosure Clipbucket V5

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable endpoint requiring authenticated session (PR:L); trivial % wildcard causes only subtitle title overwrites scoped to attacker's own data (I:L, C:N, A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 11, 2026 - 23:50 vuln.today

DescriptionCVE.org

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard characters in the subtitle editing endpoint. An authenticated user can send a % character as the number parameter to overwrite all subtitle titles of any video they own in a single HTTP request. This issue has been patched in version 5.5.3 - #141.

AnalysisAI

SQL wildcard character injection in ClipBucket v5's subtitle editing endpoint allows authenticated users to overwrite all subtitle titles across every video they own in a single HTTP request. Affected versions are all releases prior to 5.5.3 - #141 of the open-source video sharing platform maintained by MacWarrior. No public exploit exists and the vulnerability is not listed in CISA KEV, but the trivial exploitation mechanism (a single % character) means any authenticated account could cause bulk subtitle data corruption against their own content.

Technical ContextAI

ClipBucket v5 (CPE: cpe:2.3:a:macwarrior:clipbucket-v5) is an open-source PHP-based video sharing platform. The root cause is CWE-155 (Improper Neutralization of Wildcards or Matching Symbols), a subclass of improper input neutralization. The subtitle editing endpoint accepts a 'number' parameter that is passed unsanitized into a SQL query, allowing the SQL wildcard character '%' to be interpreted literally by the database engine. When '%' is submitted as the number parameter, it matches all rows in the subtitle table associated with the authenticated user's videos, causing a mass UPDATE operation that overwrites subtitle titles across all owned videos in one request. This is distinct from classic SQL injection (CWE-89) - no arbitrary SQL is injected; rather, the wildcard semantics of LIKE-style queries are abused to broaden the scope of a legitimate operation beyond the user's intent.

RemediationAI

Vendor-released patch: 5.5.3 - #141. Operators should upgrade to ClipBucket v5 version 5.5.3 - #141 or later, available via the project's GitHub repository (https://github.com/MacWarrior/clipbucket-v5). If an immediate upgrade is not feasible, a specific compensating control would be to apply server-side input validation or a WAF rule that rejects requests to the subtitle editing endpoint where the 'number' parameter contains a '%' character or is non-numeric; however, this trade-off introduces the risk of breaking legitimate wildcard search functionality if any is present in adjacent endpoints. Review subtitle data for unexpected overwrites after patching to assess whether exploitation occurred prior to remediation.