CVE-2026-32321: fallo de gravedad alta en MacWarrior clipbucket-v5
ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 0.4%
ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 #80 within the `actions/ajax.php` endpoint. Due to insufficient input sanitization of the `userid` parameter, an authenticated attacker can execute arbitrary SQL queries, leading to full database disclosure and potential administrative account takeover. Version 5.5.3 #80 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
MacWarrior · clipbucket-v5CVEs relacionadas — MacWarrior clipbucket-v5
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-21875CRITICALClipBucket v5 Vulnerable to Blind SQL Injection through Channel CommentsEPSS 1.8%CVE-2025-21624CRITICALClipBucket V5 Playlist Cover File Upload to Remote Code ExecutionEPSS 1.2%CVE-2026-80138CRITICALClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath ParameterEPSS 1.2%CVE-2025-21623HIGHClipBucket V5 Unauthenticated Template Directory Update to Denial-of-ServiceEPSS 1.2%CVE-2026-100372HIGHClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.phpEPSS 1.1%CVE-2025-21622HIGHClipBucket V5 Avatar URL Path Traversal to Arbitrary File DeleteEPSS 1.0%