Macwarrior

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-103766	SQL injection in ClipBucket v5 (all versions through 5.5.3-#197) allows an authenticated user who holds the ad_manager_access permission to inject arbitrary SQL through the delete parameter in admin_area/ads_manager.php, which is concatenated unsanitized into the AdsManager::DeleteAd DELETE statement against the ads_data table. A successful attacker can run time-based blind payloads to extract user credentials and email addresses, or directly modify and delete arbitrary records, giving high confidentiality and integrity impact on the application database. Publicly available exploit code exists (a published HackMD write-up), and while the flaw is remotely reachable it is gated behind a privileged admin-area role, so real-world exposure is limited to deployments that hand ad-manager rights to additional or semi-trusted users; no confirmed active exploitation (CISA KEV) has been reported, and an upstream fix is available as a pull request.	HIGH	8.6	0.4%	63	PoC
CVE-2026-102569	Time-based blind SQL injection in ClipBucket v5 (through 5.5.3-#197) allows an authenticated administrator who holds the video_moderation permission to inject arbitrary SQL through the videoid parameter of the admin video edit function, enabling extraction and partial modification of database contents. Exploitation requires a valid high-privilege admin session with that specific permission, so anonymous or low-privilege users cannot trigger it; once such an account is authenticated, no user interaction or non-default configuration is needed. Publicly available exploit code exists (a published two-blind-SQLi write-up), and an upstream fix is available as a commit that casts videoid to an integer; the issue is a real but modest-priority finding given the authentication prerequisite.	HIGH	7.0	0.2%	55	PoC
CVE-2026-102570	Time-based blind SQL injection in ClipBucket v5 (all builds through 5.5.3-#197) allows an authenticated administrator holding the basic_settings permission to inject arbitrary SQL through the language_id parameter of the language update function, enabling extraction or modification of database contents. The flaw is reachable over the network with no user interaction, but the high-privilege prerequisite is the primary limiting factor: neither unauthenticated nor low-privilege users can trigger it, and builds patched after upstream commit ecbdf2d5 are not affected. Publicly available exploit code exists (a published HackMD write-up demonstrating the blind SQLi), though there is no confirmed active exploitation (no CISA KEV listing); EPSS-style urgency is moderate given the admin-level access required.	HIGH	7.0	0.2%	55	PoC
CVE-2026-110626	Reflected cross-site scripting in ClipBucket v5 (builds through 5.5.3-#206) lets an attacker reflect a script payload into the ClipBucket admin panel origin by luring a logged-in administrator who holds the basic_settings permission to a crafted link targeting admin_area/language_settings.php with a malicious edit_language GET parameter. The unencoded value is echoed into a hidden input on the language edit form, so the injected script runs in the administrator's session and origin, allowing admin-context actions, session abuse and UI redressing; because the value is only reflected into a hidden field and the victim must be a privileged, already-authenticated admin who actively opens the link, exploitation is interaction-dependent rather than drive-by. Fix code is present upstream in commit 0c1b5878a6135950d8a516975c4585e3b7c8790d, which casts the parameter to int, and no KEV listing or confirmed public exploit code was observed at time of analysis - making this a moderate-severity issue with low real-world urgency.	MEDIUM	5.1	0.4%	26
CVE-2026-110625	Reflected cross-site scripting in ClipBucket v5 (affected through 5.5.3-#206) lets an unauthenticated attacker execute arbitrary JavaScript in the administrative origin by luring a currently logged-in administrator or moderator into opening a crafted /admin_area/flagged_item.php?type= URL; the type GET parameter is echoed into the admin page without encoding. Exploitation is not server-side or anonymous - it requires the victim's interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 5.1, and the vendor vector's UI:A), and because the vector is reflected rather than stored each target must individually open the attacker-supplied link, which limits breadth but not the severity of a successful admin-context script execution. A vendor fix commit that restricts type to Flag::getFlagElementTypes() is referenced in public advisories, and no public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is concentrated in deployments that have not yet applied the upstream fix.	MEDIUM	5.1	0.4%	26
CVE-2026-110627	Reflected cross-site scripting in ClipBucket v5 (through 5.5.3-#206) allows an attacker to have arbitrary HTML and script executed in the origin of the admin panel by luring a logged-in administrator into submitting a forged cross-site POST to admin_area/index.php with mode=add_todo and a malicious val parameter; the endpoint carries no CSRF token, and the val value is echoed back through nl2br() without output encoding. The attacker requires no authentication of their own (PR:N in the published CVSS 4.0 vector), but exploitation is not self-executing: it depends on an active administrator session and on that admin being convinced to submit the crafted request (UI:A), and the consequence is script execution inside the admin panel origin rather than direct server compromise. No public exploit code was identified at time of analysis and there is no evidence of active exploitation; scoring is low (CVSS 4.0 base 2.1; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), making this a genuinely low-priority finding whose risk is bounded by the required victim interaction and privileged session.	LOW	2.1	0.4%	10

CVE-2026-103766

SQL injection in ClipBucket v5 (all versions through 5.5.3-#197) allows an authenticated user who holds the ad_manager_access permission to inject arbitrary SQL through the delete parameter in admin_area/ads_manager.php, which is concatenated unsanitized into the AdsManager::DeleteAd DELETE statement against the ads_data table. A successful attacker can run time-based blind payloads to extract user credentials and email addresses, or directly modify and delete arbitrary records, giving high confidentiality and integrity impact on the application database. Publicly available exploit code exists (a published HackMD write-up), and while the flaw is remotely reachable it is gated behind a privileged admin-area role, so real-world exposure is limited to deployments that hand ad-manager rights to additional or semi-trusted users; no confirmed active exploitation (CISA KEV) has been reported, and an upstream fix is available as a pull request.

HIGH

8.6

0.4%

63

PoC

CVE-2026-102569

Time-based blind SQL injection in ClipBucket v5 (through 5.5.3-#197) allows an authenticated administrator who holds the video_moderation permission to inject arbitrary SQL through the videoid parameter of the admin video edit function, enabling extraction and partial modification of database contents. Exploitation requires a valid high-privilege admin session with that specific permission, so anonymous or low-privilege users cannot trigger it; once such an account is authenticated, no user interaction or non-default configuration is needed. Publicly available exploit code exists (a published two-blind-SQLi write-up), and an upstream fix is available as a commit that casts videoid to an integer; the issue is a real but modest-priority finding given the authentication prerequisite.

HIGH

7.0

0.2%

55

PoC

CVE-2026-102570

Time-based blind SQL injection in ClipBucket v5 (all builds through 5.5.3-#197) allows an authenticated administrator holding the basic_settings permission to inject arbitrary SQL through the language_id parameter of the language update function, enabling extraction or modification of database contents. The flaw is reachable over the network with no user interaction, but the high-privilege prerequisite is the primary limiting factor: neither unauthenticated nor low-privilege users can trigger it, and builds patched after upstream commit ecbdf2d5 are not affected. Publicly available exploit code exists (a published HackMD write-up demonstrating the blind SQLi), though there is no confirmed active exploitation (no CISA KEV listing); EPSS-style urgency is moderate given the admin-level access required.

HIGH

7.0

0.2%

55

PoC

CVE-2026-110626

Reflected cross-site scripting in ClipBucket v5 (builds through 5.5.3-#206) lets an attacker reflect a script payload into the ClipBucket admin panel origin by luring a logged-in administrator who holds the basic_settings permission to a crafted link targeting admin_area/language_settings.php with a malicious edit_language GET parameter. The unencoded value is echoed into a hidden input on the language edit form, so the injected script runs in the administrator's session and origin, allowing admin-context actions, session abuse and UI redressing; because the value is only reflected into a hidden field and the victim must be a privileged, already-authenticated admin who actively opens the link, exploitation is interaction-dependent rather than drive-by. Fix code is present upstream in commit 0c1b5878a6135950d8a516975c4585e3b7c8790d, which casts the parameter to int, and no KEV listing or confirmed public exploit code was observed at time of analysis - making this a moderate-severity issue with low real-world urgency.

MEDIUM

5.1

0.4%

26

CVE-2026-110625

Reflected cross-site scripting in ClipBucket v5 (affected through 5.5.3-#206) lets an unauthenticated attacker execute arbitrary JavaScript in the administrative origin by luring a currently logged-in administrator or moderator into opening a crafted /admin_area/flagged_item.php?type= URL; the type GET parameter is echoed into the admin page without encoding. Exploitation is not server-side or anonymous - it requires the victim's interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 5.1, and the vendor vector's UI:A), and because the vector is reflected rather than stored each target must individually open the attacker-supplied link, which limits breadth but not the severity of a successful admin-context script execution. A vendor fix commit that restricts type to Flag::getFlagElementTypes() is referenced in public advisories, and no public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is concentrated in deployments that have not yet applied the upstream fix.

MEDIUM

5.1

0.4%

26

CVE-2026-110627

Reflected cross-site scripting in ClipBucket v5 (through 5.5.3-#206) allows an attacker to have arbitrary HTML and script executed in the origin of the admin panel by luring a logged-in administrator into submitting a forged cross-site POST to admin_area/index.php with mode=add_todo and a malicious val parameter; the endpoint carries no CSRF token, and the val value is echoed back through nl2br() without output encoding. The attacker requires no authentication of their own (PR:N in the published CVSS 4.0 vector), but exploitation is not self-executing: it depends on an active administrator session and on that admin being convinced to submit the crafted request (UI:A), and the consequence is script execution inside the admin panel origin rather than direct server compromise. No public exploit code was identified at time of analysis and there is no evidence of active exploitation; scoring is low (CVSS 4.0 base 2.1; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), making this a genuinely low-priority finding whose risk is bounded by the required victim interaction and privileged session.

LOW

2.1

0.4%

10

Severity Breakdown

Monthly CVE Trend

Affected Products (2)

Top Risky CVEs