What is the CVSS score of EUVD-2026-12960?

EUVD-2026-12960 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-12960?

ClipBucket v5 versions before 5.5.3 contain a SQL injection vulnerability in the userid parameter that allows authenticated users to extract sensitive data and compromise administrative accounts.. A patch is available.

How to fix or mitigate EUVD-2026-12960?

Within 24 hours: inventory all ClipBucket v5 deployments and confirm current versions. Within 7 days: apply vendor patch to ClipBucket v5.5.3 #80 or later across all instances; test in non-production environment first. Within 30 days: audit database access logs for suspicious SQL patterns and reset all administrative credentials post-patch.

PHP EUVD-2026-12960

| CVE-2026-32321 HIGH

SQL Injection (CWE-89)

2026-03-18 GitHub_M

SQLi PHP Clipbucket V5

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:20 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

5.5.3

EUVD ID Assigned

Mar 18, 2026 - 21:00 euvd

EUVD-2026-12960

Analysis Generated

Mar 18, 2026 - 21:00 vuln.today

CVE Published

Mar 18, 2026 - 20:37 nvd

HIGH 8.8

DescriptionGitHub Advisory

ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 #80 within the actions/ajax.php endpoint. Due to insufficient input sanitization of the userid parameter, an authenticated attacker can execute arbitrary SQL queries, leading to full database disclosure and potential administrative account takeover. Version 5.5.3 #80 fixes the issue.

AnalysisAI

An authenticated time-based blind SQL injection vulnerability exists in the ClipBucket v5 open source video sharing platform, affecting versions prior to 5.5.3 #80. The vulnerability resides in the actions/ajax.php endpoint where the userid parameter lacks proper input sanitization, allowing authenticated attackers to execute arbitrary SQL queries. This can lead to full database disclosure and potential administrative account takeover with a CVSS score of 8.8.

Technical ContextAI

ClipBucket v5 is a PHP-based open source video sharing platform identified by CPE cpe:2.3:a:macwarrior:clipbucket-v5. The vulnerability is classified as CWE-89 (SQL Injection), specifically a time-based blind variant. This type of injection occurs when user-supplied input is not properly validated or sanitized before being incorporated into SQL queries. In this case, the userid parameter in the actions/ajax.php AJAX endpoint is vulnerable, allowing attackers to craft malicious SQL payloads that execute on the backend database. Time-based blind SQL injection relies on database response timing to infer information when direct output is not visible, making exploitation slower but still viable for complete data extraction.

RemediationAI

Upgrade ClipBucket v5 to version 5.5.3 #80 or later, which contains the fix for this SQL injection vulnerability as documented in the GitHub security advisory at https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-2757-6cp4-v7xx. The specific patch commit can be reviewed at https://github.com/MacWarrior/clipbucket-v5/commit/726d68b0c9d4c702dce2691c2759b6bf84a1691f for organizations requiring code-level verification before deployment. Until patching is completed, implement defense-in-depth measures including restricting authenticated user privileges to minimum necessary levels, implementing Web Application Firewall (WAF) rules to detect and block SQL injection patterns targeting the actions/ajax.php endpoint, monitoring database query logs for suspicious time-delay patterns indicative of blind SQL injection attempts, and limiting network access to the ClipBucket platform to trusted IP ranges where feasible.