Macwarrior

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-100372	Authenticated administrators of ClipBucket v5 who hold the manage_template_access permission can abuse a path traversal in the admin template editor (template_editor.php) to write attacker-controlled PHP files outside the intended styles/layout directory and have them executed as the web server user, yielding remote code execution on all versions before 5.5.3-#197. Publicly available exploit code exists (a HackMD writeup linked from the CVE record), and the vendor has released a fix in commit f31de49b and release tag 5.5.3-#197; the bug is access-gated by the administrator privilege and permission requirement (CVSS 4.0 base 8.6, PR:H), and there is no confirmed active exploitation in CISA KEV. This is a genuine but access-gated risk that primarily matters where multiple admin accounts exist or admin credentials are weak or reused.	HIGH	8.6	1.1%	64	PoC
CVE-2026-96272	Unauthenticated blind SQL injection in ClipBucket v5 (before 5.5.3-#182) allows remote attackers to extract sensitive database contents-including user credentials, email addresses, and administrator password hashes-via the photo search endpoint's unsanitized query parameter. Publicly available exploit code exists (HackMD writeup), and the vendor has released a patch (PR #874 / commit 7fd0af6f) that applies mysql_clean() to the vulnerable input. Because the vulnerability requires no authentication or user interaction and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact, this is a genuine priority for immediate remediation; successful exploitation can lead to account takeover after offline cracking of admin hashes.	HIGH	8.7	0.5%	64	PoC
CVE-2026-103766	SQL injection in ClipBucket v5 (all versions through 5.5.3-#197) allows an authenticated user who holds the ad_manager_access permission to inject arbitrary SQL through the delete parameter in admin_area/ads_manager.php, which is concatenated unsanitized into the AdsManager::DeleteAd DELETE statement against the ads_data table. A successful attacker can run time-based blind payloads to extract user credentials and email addresses, or directly modify and delete arbitrary records, giving high confidentiality and integrity impact on the application database. Publicly available exploit code exists (a published HackMD write-up), and while the flaw is remotely reachable it is gated behind a privileged admin-area role, so real-world exposure is limited to deployments that hand ad-manager rights to additional or semi-trusted users; no confirmed active exploitation (CISA KEV) has been reported, and an upstream fix is available as a pull request.	HIGH	8.6	0.4%	63	PoC
CVE-2026-102569	Time-based blind SQL injection in ClipBucket v5 (through 5.5.3-#197) allows an authenticated administrator who holds the video_moderation permission to inject arbitrary SQL through the videoid parameter of the admin video edit function, enabling extraction and partial modification of database contents. Exploitation requires a valid high-privilege admin session with that specific permission, so anonymous or low-privilege users cannot trigger it; once such an account is authenticated, no user interaction or non-default configuration is needed. Publicly available exploit code exists (a published two-blind-SQLi write-up), and an upstream fix is available as a commit that casts videoid to an integer; the issue is a real but modest-priority finding given the authentication prerequisite.	HIGH	7.0	0.2%	55	PoC
CVE-2026-102570	Time-based blind SQL injection in ClipBucket v5 (all builds through 5.5.3-#197) allows an authenticated administrator holding the basic_settings permission to inject arbitrary SQL through the language_id parameter of the language update function, enabling extraction or modification of database contents. The flaw is reachable over the network with no user interaction, but the high-privilege prerequisite is the primary limiting factor: neither unauthenticated nor low-privilege users can trigger it, and builds patched after upstream commit ecbdf2d5 are not affected. Publicly available exploit code exists (a published HackMD write-up demonstrating the blind SQLi), though there is no confirmed active exploitation (no CISA KEV listing); EPSS-style urgency is moderate given the admin-level access required.	HIGH	7.0	0.2%	55	PoC
CVE-2026-95812	Reflected cross-site scripting (CWE-79) in ClipBucket v5 before 5.5.3-#182 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser under the application origin by crafting URLs whose cat, sort, or time query parameters are processed by the unsanitized sort_link() helper. Exploitation requires the victim to click a crafted link (user interaction), public exploit code is available, and there is no indication of confirmed active exploitation (no CISA KEV listing); impact is confined to the victim's browser session rather than server-side code execution.	MEDIUM	5.3	0.4%	47	PoC
CVE-2026-80138	OS command injection in ClipBucket V5's web installer (versions 5.5.1 through 5.5.3-#153) lets unauthenticated remote attackers run arbitrary shell commands as the web server user by supplying a crafted php_cli_filepath value in a POST request to the installer. The flaw stems from the installer passing this parameter unescaped into a shell command that invokes the PHP CLI. A vendor patch exists (commit 36e7c6c), it was reported by VulnCheck, and no public exploit has been identified at time of analysis.	CRITICAL	9.2	0.8%	47
CVE-2026-77929	Remote code execution in ClipBucket v5 (all releases before 5.5.3-#182) allows an authenticated low-privileged user to upload a PHP file that is stored and later executed by PHP-FPM, yielding full server compromise. The photo upload endpoint validates only the file's MIME type/magic bytes but never rewrites the extension, so a payload beginning with valid image magic bytes retains its .php extension on disk (CWE-434, CVSS 4.0 base 8.7 / independently assessed CVSS 3.1 as AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H). Exploitation requires only a standard account - readily self-registered on default deployments with open registration - plus a web-executable upload directory served by PHP-FPM; there is no unauthenticated path and no public exploit code identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV).	HIGH	8.7	0.5%	44
CVE-2026-77927	Authenticated users of ClipBucket v5 through 5.5.3 can extract arbitrary data - including credential hashes - from the underlying database by abusing a time-based blind SQL injection in the back-office bulk photo-deletion handler. The root cause is a parameter-type bypass: submitting the check_photo parameter as an array causes its elements to slip past the clean_requests() sanitization in ClipBucket.class.php and reach photo_exists() in photos.class.php, where non-numeric values are concatenated directly into a SQL query. Exploitation requires a valid ClipBucket account able to reach manage_photos.php (CVSS vector shows PR:L, unauthenticated access is not sufficient), the injection is blind and time-based so extraction is slow and iterative, and no public exploit code has been identified at time of analysis; EPSS scoring was not provided in the source data. This is a moderate-risk, authentication-gated data-disclosure flaw rather than a critical exposure.	HIGH	7.1	0.4%	36
CVE-2026-77928	Authenticated SQL injection in ClipBucket v5 (through release 5.5.3) lets any logged-in user read arbitrary database contents - including all user credential hashes and email addresses - by submitting the msg_id parameter as an array to the private-message deletion handler. The array form evades the clean_requests() sanitizer in ClipBucket.class.php, so unsanitized elements reach cb_pm::delete_msg(), which interpolates the message ID directly into a SQL query string and supports time-based blind extraction. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms a low-privilege authenticated remote attacker with high confidentiality impact only; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).	HIGH	7.1	0.3%	36
CVE-2026-110626	Reflected cross-site scripting in ClipBucket v5 (builds through 5.5.3-#206) lets an attacker reflect a script payload into the ClipBucket admin panel origin by luring a logged-in administrator who holds the basic_settings permission to a crafted link targeting admin_area/language_settings.php with a malicious edit_language GET parameter. The unencoded value is echoed into a hidden input on the language edit form, so the injected script runs in the administrator's session and origin, allowing admin-context actions, session abuse and UI redressing; because the value is only reflected into a hidden field and the victim must be a privileged, already-authenticated admin who actively opens the link, exploitation is interaction-dependent rather than drive-by. Fix code is present upstream in commit 0c1b5878a6135950d8a516975c4585e3b7c8790d, which casts the parameter to int, and no KEV listing or confirmed public exploit code was observed at time of analysis - making this a moderate-severity issue with low real-world urgency.	MEDIUM	5.1	0.4%	26
CVE-2026-110625	Reflected cross-site scripting in ClipBucket v5 (affected through 5.5.3-#206) lets an unauthenticated attacker execute arbitrary JavaScript in the administrative origin by luring a currently logged-in administrator or moderator into opening a crafted /admin_area/flagged_item.php?type= URL; the type GET parameter is echoed into the admin page without encoding. Exploitation is not server-side or anonymous - it requires the victim's interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 5.1, and the vendor vector's UI:A), and because the vector is reflected rather than stored each target must individually open the attacker-supplied link, which limits breadth but not the severity of a successful admin-context script execution. A vendor fix commit that restricts type to Flag::getFlagElementTypes() is referenced in public advisories, and no public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is concentrated in deployments that have not yet applied the upstream fix.	MEDIUM	5.1	0.4%	26
CVE-2026-110627	Reflected cross-site scripting in ClipBucket v5 (through 5.5.3-#206) allows an attacker to have arbitrary HTML and script executed in the origin of the admin panel by luring a logged-in administrator into submitting a forged cross-site POST to admin_area/index.php with mode=add_todo and a malicious val parameter; the endpoint carries no CSRF token, and the val value is echoed back through nl2br() without output encoding. The attacker requires no authentication of their own (PR:N in the published CVSS 4.0 vector), but exploitation is not self-executing: it depends on an active administrator session and on that admin being convinced to submit the crafted request (UI:A), and the consequence is script execution inside the admin panel origin rather than direct server compromise. No public exploit code was identified at time of analysis and there is no evidence of active exploitation; scoring is low (CVSS 4.0 base 2.1; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), making this a genuinely low-priority finding whose risk is bounded by the required victim interaction and privileged session.	LOW	2.1	0.4%	10

CVE-2026-100372

Authenticated administrators of ClipBucket v5 who hold the manage_template_access permission can abuse a path traversal in the admin template editor (template_editor.php) to write attacker-controlled PHP files outside the intended styles/layout directory and have them executed as the web server user, yielding remote code execution on all versions before 5.5.3-#197. Publicly available exploit code exists (a HackMD writeup linked from the CVE record), and the vendor has released a fix in commit f31de49b and release tag 5.5.3-#197; the bug is access-gated by the administrator privilege and permission requirement (CVSS 4.0 base 8.6, PR:H), and there is no confirmed active exploitation in CISA KEV. This is a genuine but access-gated risk that primarily matters where multiple admin accounts exist or admin credentials are weak or reused.

HIGH

8.6

1.1%

64

PoC

CVE-2026-96272

Unauthenticated blind SQL injection in ClipBucket v5 (before 5.5.3-#182) allows remote attackers to extract sensitive database contents-including user credentials, email addresses, and administrator password hashes-via the photo search endpoint's unsanitized query parameter. Publicly available exploit code exists (HackMD writeup), and the vendor has released a patch (PR #874 / commit 7fd0af6f) that applies mysql_clean() to the vulnerable input. Because the vulnerability requires no authentication or user interaction and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact, this is a genuine priority for immediate remediation; successful exploitation can lead to account takeover after offline cracking of admin hashes.

HIGH

8.7

0.5%

64

PoC

CVE-2026-103766

SQL injection in ClipBucket v5 (all versions through 5.5.3-#197) allows an authenticated user who holds the ad_manager_access permission to inject arbitrary SQL through the delete parameter in admin_area/ads_manager.php, which is concatenated unsanitized into the AdsManager::DeleteAd DELETE statement against the ads_data table. A successful attacker can run time-based blind payloads to extract user credentials and email addresses, or directly modify and delete arbitrary records, giving high confidentiality and integrity impact on the application database. Publicly available exploit code exists (a published HackMD write-up), and while the flaw is remotely reachable it is gated behind a privileged admin-area role, so real-world exposure is limited to deployments that hand ad-manager rights to additional or semi-trusted users; no confirmed active exploitation (CISA KEV) has been reported, and an upstream fix is available as a pull request.

HIGH

8.6

0.4%

63

PoC

CVE-2026-102569

Time-based blind SQL injection in ClipBucket v5 (through 5.5.3-#197) allows an authenticated administrator who holds the video_moderation permission to inject arbitrary SQL through the videoid parameter of the admin video edit function, enabling extraction and partial modification of database contents. Exploitation requires a valid high-privilege admin session with that specific permission, so anonymous or low-privilege users cannot trigger it; once such an account is authenticated, no user interaction or non-default configuration is needed. Publicly available exploit code exists (a published two-blind-SQLi write-up), and an upstream fix is available as a commit that casts videoid to an integer; the issue is a real but modest-priority finding given the authentication prerequisite.

HIGH

7.0

0.2%

55

PoC

CVE-2026-102570

Time-based blind SQL injection in ClipBucket v5 (all builds through 5.5.3-#197) allows an authenticated administrator holding the basic_settings permission to inject arbitrary SQL through the language_id parameter of the language update function, enabling extraction or modification of database contents. The flaw is reachable over the network with no user interaction, but the high-privilege prerequisite is the primary limiting factor: neither unauthenticated nor low-privilege users can trigger it, and builds patched after upstream commit ecbdf2d5 are not affected. Publicly available exploit code exists (a published HackMD write-up demonstrating the blind SQLi), though there is no confirmed active exploitation (no CISA KEV listing); EPSS-style urgency is moderate given the admin-level access required.

HIGH

7.0

0.2%

55

PoC

CVE-2026-95812

Reflected cross-site scripting (CWE-79) in ClipBucket v5 before 5.5.3-#182 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser under the application origin by crafting URLs whose cat, sort, or time query parameters are processed by the unsanitized sort_link() helper. Exploitation requires the victim to click a crafted link (user interaction), public exploit code is available, and there is no indication of confirmed active exploitation (no CISA KEV listing); impact is confined to the victim's browser session rather than server-side code execution.

MEDIUM

5.3

0.4%

47

PoC

CVE-2026-80138

OS command injection in ClipBucket V5's web installer (versions 5.5.1 through 5.5.3-#153) lets unauthenticated remote attackers run arbitrary shell commands as the web server user by supplying a crafted php_cli_filepath value in a POST request to the installer. The flaw stems from the installer passing this parameter unescaped into a shell command that invokes the PHP CLI. A vendor patch exists (commit 36e7c6c), it was reported by VulnCheck, and no public exploit has been identified at time of analysis.

CRITICAL

9.2

0.8%

47

CVE-2026-77929

Remote code execution in ClipBucket v5 (all releases before 5.5.3-#182) allows an authenticated low-privileged user to upload a PHP file that is stored and later executed by PHP-FPM, yielding full server compromise. The photo upload endpoint validates only the file's MIME type/magic bytes but never rewrites the extension, so a payload beginning with valid image magic bytes retains its .php extension on disk (CWE-434, CVSS 4.0 base 8.7 / independently assessed CVSS 3.1 as AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H). Exploitation requires only a standard account - readily self-registered on default deployments with open registration - plus a web-executable upload directory served by PHP-FPM; there is no unauthenticated path and no public exploit code identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV).

HIGH

8.7

0.5%

44

CVE-2026-77927

Authenticated users of ClipBucket v5 through 5.5.3 can extract arbitrary data - including credential hashes - from the underlying database by abusing a time-based blind SQL injection in the back-office bulk photo-deletion handler. The root cause is a parameter-type bypass: submitting the check_photo parameter as an array causes its elements to slip past the clean_requests() sanitization in ClipBucket.class.php and reach photo_exists() in photos.class.php, where non-numeric values are concatenated directly into a SQL query. Exploitation requires a valid ClipBucket account able to reach manage_photos.php (CVSS vector shows PR:L, unauthenticated access is not sufficient), the injection is blind and time-based so extraction is slow and iterative, and no public exploit code has been identified at time of analysis; EPSS scoring was not provided in the source data. This is a moderate-risk, authentication-gated data-disclosure flaw rather than a critical exposure.

HIGH

7.1

0.4%

36

CVE-2026-77928

Authenticated SQL injection in ClipBucket v5 (through release 5.5.3) lets any logged-in user read arbitrary database contents - including all user credential hashes and email addresses - by submitting the msg_id parameter as an array to the private-message deletion handler. The array form evades the clean_requests() sanitizer in ClipBucket.class.php, so unsanitized elements reach cb_pm::delete_msg(), which interpolates the message ID directly into a SQL query string and supports time-based blind extraction. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms a low-privilege authenticated remote attacker with high confidentiality impact only; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).

HIGH

7.1

0.3%

36

CVE-2026-110626

Reflected cross-site scripting in ClipBucket v5 (builds through 5.5.3-#206) lets an attacker reflect a script payload into the ClipBucket admin panel origin by luring a logged-in administrator who holds the basic_settings permission to a crafted link targeting admin_area/language_settings.php with a malicious edit_language GET parameter. The unencoded value is echoed into a hidden input on the language edit form, so the injected script runs in the administrator's session and origin, allowing admin-context actions, session abuse and UI redressing; because the value is only reflected into a hidden field and the victim must be a privileged, already-authenticated admin who actively opens the link, exploitation is interaction-dependent rather than drive-by. Fix code is present upstream in commit 0c1b5878a6135950d8a516975c4585e3b7c8790d, which casts the parameter to int, and no KEV listing or confirmed public exploit code was observed at time of analysis - making this a moderate-severity issue with low real-world urgency.

MEDIUM

5.1

0.4%

26

CVE-2026-110625

Reflected cross-site scripting in ClipBucket v5 (affected through 5.5.3-#206) lets an unauthenticated attacker execute arbitrary JavaScript in the administrative origin by luring a currently logged-in administrator or moderator into opening a crafted /admin_area/flagged_item.php?type= URL; the type GET parameter is echoed into the admin page without encoding. Exploitation is not server-side or anonymous - it requires the victim's interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 5.1, and the vendor vector's UI:A), and because the vector is reflected rather than stored each target must individually open the attacker-supplied link, which limits breadth but not the severity of a successful admin-context script execution. A vendor fix commit that restricts type to Flag::getFlagElementTypes() is referenced in public advisories, and no public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is concentrated in deployments that have not yet applied the upstream fix.

MEDIUM

5.1

0.4%

26

CVE-2026-110627

Reflected cross-site scripting in ClipBucket v5 (through 5.5.3-#206) allows an attacker to have arbitrary HTML and script executed in the origin of the admin panel by luring a logged-in administrator into submitting a forged cross-site POST to admin_area/index.php with mode=add_todo and a malicious val parameter; the endpoint carries no CSRF token, and the val value is echoed back through nl2br() without output encoding. The attacker requires no authentication of their own (PR:N in the published CVSS 4.0 vector), but exploitation is not self-executing: it depends on an active administrator session and on that admin being convinced to submit the crafted request (UI:A), and the consequence is script execution inside the admin panel origin rather than direct server compromise. No public exploit code was identified at time of analysis and there is no evidence of active exploitation; scoring is low (CVSS 4.0 base 2.1; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), making this a genuinely low-priority finding whose risk is bounded by the required victim interaction and privileged session.

LOW

2.1

0.4%

10

Severity Breakdown

Monthly CVE Trend

Affected Products (2)

Top Risky CVEs