ClipBucket EUVD-2026-101254

Requires an authenticated administrator holding the basic_settings permission to be logged into ClipBucket v5 and to actively open an attacker-supplied link targeting admin_area/language_settings.php with a crafted edit_language parameter. The payload is reflected unencoded into a hidden input value field, so exploitation depends on the victim's active session and interaction (UI:A) - it is not drive-by or self-contained. Limiting factors: the target must be a privileged admin (not any user), must click the link, and the instance must be at or below version 5.5.3-#206 (patched builds cast the parameter to int, neutralizing the vector).

This is a moderate-severity reflected XSS (CWE-79) whose signals point to low real-world urgency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) scores 5.1: network-reachable and low-complexity, but exploitation is gated on active user interaction (UI:A) by a specific victim - an administrator holding the basic_settings permission. Impact is confined to the subsequent-system confidentiality and integrity of the admin-panel origin (SC:L/SI:L); there is no impact to the vulnerable system itself (VC:N/VI:N/VA:N) and no availability impact. No EPSS score was provided, and the CVE is NOT on CISA KEV, so there is no evidence of active or widespread exploitation. A public technical writeup (hackmd) plus the vendor patch commit disclose the exact sink, so working exploit knowledge is effectively public. Net assessment: a legitimate bug worth patching, but a targeted social-engineering issue against privileged users rather than a mass-exploitable priority. One tension to verify: PR:N labels the attacker as unauthenticated, yet successful payload execution requires an authenticated admin to open the crafted link - the privilege burden sits on the victim, not the attacker.

An attacker crafts a URL to admin_area/language_settings.php with a malicious payload in the edit_language GET parameter and sends it to an administrator with basic_settings permission (e.g., via email or chat). When the admin opens the link while logged in, the unencoded value is echoed into a hidden input and the script executes in the admin-panel origin, enabling session/action abuse. A public proof-of-concept writeup exists; attack complexity is low, but the attack requires the admin to actively click the link (UI:A).