EUVD-2026-82938
GHSA-wwv3-r4qp-89fg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable low-complexity SQLi requiring any authenticated account (PR:L, UI:N); time-based blind read enables full database disclosure (C:H) but no write or availability impact (I:N/A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
ClipBucket v5 through 5.5.3 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitting the msg_id parameter as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php. Attackers can pass unsanitized array elements through the deletion handler in private_message.php into cb_pm::delete_msg(), which interpolates the unescaped message ID directly into a SQL query string, enabling time-based blind SQL injection to retrieve all user credential hashes and email addresses.
AnalysisAI
Authenticated SQL injection in ClipBucket v5 (through release 5.5.3) lets any logged-in user read arbitrary database contents - including all user credential hashes and email addresses - by submitting the msg_id parameter as an array to the private-message deletion handler. The array form evades the clean_requests() sanitizer in ClipBucket.class.php, so unsanitized elements reach cb_pm::delete_msg(), which interpolates the message ID directly into a SQL query string and supports time-based blind extraction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated ClipBucket v5 account (any user able to reach the private-message deletion handler in private_message.php); PR:L per the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, actionable but mid-tier priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor patch by upgrading to the ClipBucket v5 5.5.3-#182 release or later, which contains the upstream fix commit 85907c5fd1205ccae98c214bed4b3421c632f90c (release notes at https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.3-%23182 and advisory at https://www.vulncheck.com/advisories/clipbucket-blind-sql-injection-via-private-message-deletion-endpoint); because that release bundles other security fixes as well, upgrade to the newest available v5 build rather than assuming an earlier 5.5.3 package is fixed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether ClipBucket v5 (through release 5.5.3) is deployed anywhere in the estate, and if so treat the instance as compromised-adjacent: restrict or temporarily suspend the private-messaging deletion functionality if it can be disabled without service disruption, restrict self-registration and review the list of accounts with messaging access, and begin capturing database and web access logs for retrospective analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today