These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A reflected cross-site scripting vulnerability exists in ClipBucket v5 through 5.5.3-#206 in the admin_area/index.php file, allowing attackers to inject HTML via the val parameter in mode=add_todo. This issue can be exploited by luring a logged-in administrator into submitting a cross-site POST form without CSRF protection, leading to script execution in the admin panel.
CVE-2026-110626 is a reflected cross-site scripting vulnerability in ClipBucket v5 through 5.5.3-#206. The vulnerability exists in the admin_area/language_settings.php file via the unencoded edit_language GET parameter. Attackers can send administrators with basic_settings permission a crafted link whose payload is echoed into a hidden input, executing script in the admin panel origin.
The CVE-2026-110625 vulnerability is a reflected cross-site scripting (XSS) issue in ClipBucket versions 5 through 5.5.3-#206, specifically in the admin_area/flagged_item.php file via the unencoded type GET parameter. This vulnerability allows attackers to execute injected scripts in the admin panel by sending crafted links to logged-in administrators or moderators. The vulnerability has a CVSS score of 5 [truncated]
CVE-2026-100372 is a high-severity path traversal vulnerability in ClipBucket v5 before 5.5.3-#197. Authenticated administrators with manage_template_access permission can overwrite PHP files by supplying directory traversal sequences in the folder parameter of the admin template editor. This could lead to remote code execution as the web server user. Administrators and security teams should assess exposu [truncated]
CVE-2026-96272 is a blind SQL injection vulnerability in ClipBucket v5 before 5.5.3-#182. The vulnerability exists in the photo search endpoint, where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. This allows unauthenticated attackers to exploit time-based blind SQL injection techniques to extract user credentials, email addresses, and administrator password hashes for acc [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-25T23:17:59.860Z and has not been modified since then. ClipBucket V5's web installer is vulnerable to unauthenticated OS command injection due to improper validation or escaping of the php_cli_filepath parameter. Attackers can submit a crafted POST request to execute arbitrary commands as the web se [truncated]
CVE-2026-49482 is a vulnerability in ClipBucket v5, an open-source video sharing platform. The vulnerability allows an authenticated user to overwrite all video subtitle titles by sending a % character as the number parameter in a single HTTP request to the subtitle editing endpoint. This is due to improper neutralization of SQL wildcard characters. The vulnerability has been patched in version 5.5.3 - #141.
CVE-2026-47238 is a medium-severity vulnerability in ClipBucket v5 that allows authenticated users to edit video subtitles of other users due to a lack of authorization. This issue was patched in version 5.5.3 - #133.
CVE-2026-45418 is a high-severity vulnerability in ClipBucket v5, a open-source video sharing platform. The vulnerability exists in the POST /actions/subtitle_edit.php request, where an authenticated user can inject malicious SQL code via the number parameter. This allows for a boolean-based blind SQL injection attack, enabling the exfiltration of sensitive data. The vulnerability has been patched in vers [truncated]
CVE-2026-45060 is a critical vulnerability in ClipBucket v5, an open-source video sharing platform. The vulnerability is caused by a blind SQL injection in the actions/progress_video.php endpoint, which allows unauthenticated users to execute SQL queries and exfiltrate sensitive data. The vulnerability has been patched in version 5.5.3 - #129.
CVE-2026-42846 is a critical vulnerability in ClipBucket v5, a open source video sharing platform. The vulnerability exists in the Remote Play feature, which allows authenticated users to add videos by importing external URLs. Due to improper escaping of user-input URLs, an attacker can inject shell metacharacters, leading to arbitrary command execution on the server. This vulnerability has a CVSS score o [truncated]