CVE-2025-62715: medium-severity vulnerability in MacWarrior clipbucket-v5
ClipBucket v5: Stored XSS via Collection Tags
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.2%
ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#147 and below contain a stored Cross-Site Scripting (XSS) vulnerability in ClipBucket’s Collection tags feature. An authenticated normal user can create a tag containing HTML or JavaScript, which is later rendered unescaped in collection detail and tag-list pages. As a result, arbitrary JavaScript executes in the browsers of all users who view the affected pages. This issue is fixed in version 5.5.2-#152.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
MacWarrior · clipbucket-v5Related CVEs — MacWarrior clipbucket-v5
In the same product, most dangerous first.
CVE-2026-21875CRITICALClipBucket v5 Vulnerable to Blind SQL Injection through Channel CommentsEPSS 1.8%CVE-2025-21624CRITICALClipBucket V5 Playlist Cover File Upload to Remote Code ExecutionEPSS 1.2%CVE-2026-80138CRITICALClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath ParameterEPSS 1.2%CVE-2025-21623HIGHClipBucket V5 Unauthenticated Template Directory Update to Denial-of-ServiceEPSS 1.2%CVE-2026-100372HIGHClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.phpEPSS 1.1%CVE-2025-21622HIGHClipBucket V5 Avatar URL Path Traversal to Arbitrary File DeleteEPSS 1.0%