CVE-2026-32321 PUBLISHED

ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration

Assigner: GitHub_M
Reserved: 11.03.2026 Published: 18.03.2026 Updated: 18.03.2026

ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 #80 within the actions/ajax.php endpoint. Due to insufficient input sanitization of the userid parameter, an authenticated attacker can execute arbitrary SQL queries, leading to full database disclosure and potential administrative account takeover. Version 5.5.3 #80 fixes the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor MacWarrior
Product clipbucket-v5
Versions
  • Version < 5.5.3 - #80 is affected

References

Problem Types

  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE