ClipBucket EUVD-2026-101255

Exploitation requires (1) a victim who is a currently authenticated ClipBucket v5 administrator with an active session, (2) that admin being lured into submitting an attacker-controlled cross-site POST request to admin_area/index.php with mode=add_todo and a malicious val parameter, and (3) the endpoint's absence of a CSRF token, which lets the forged request succeed. The vulnerable sink is the val value being returned via nl2br() without output encoding. Limiting factors that reduce real-world risk: it is not remotely self-executing - it depends on active user interaction (UI:A) and a valid admin session, so it cannot be mass-exploited or wormed, and impact is confined to script execution in the admin panel origin rather than direct server compromise.

This is a genuinely low-priority issue, and the signals agree rather than conflict. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, base 2.1) describes a network-reachable but interaction-dependent flaw with no impact on the vulnerable system itself and only low confidentiality/integrity impact on a subsequent system (the admin's browser session). The AT:P (attack requirement present) and UI:A (active user interaction) metrics correctly capture that an attacker cannot act alone: a logged-in administrator must be socially engineered into submitting a cross-site POST, and the app's lack of a CSRF token is what makes that forgery succeed. There is no CISA KEV listing, and no EPSS score was provided in the input - EPSS data is MISSING and should be checked, though for a reflected XSS in a niche product it would almost certainly be very low. POC status is not explicitly flagged, but a HackMD write-up and a VulnCheck advisory are referenced and likely contain technical detail or a working form; treat public exploit detail as plausibly available. Bottom line: a vendor-patched, low-CVSS reflected XSS that is real but requires targeted phishing of an authenticated admin - patch on a normal cycle rather than treating it as an emergency.

An attacker hosts a malicious web page containing an auto-submitting cross-site POST form targeting admin_area/index.php with mode=add_todo and a script payload in the val parameter. They lure a currently logged-in ClipBucket administrator to the page; because the endpoint has no CSRF protection, the forged request is accepted and the unsanitized value is reflected back via nl2br, executing attacker script in the admin panel origin. A technical write-up (HackMD) and a VulnCheck advisory are referenced, so exploitation detail is likely publicly documented.