ClipBucket v5 <= 5.5.2 - Unauthenticated Blind SQL Injection

ClipBucket v5.5.2-187 and below contain a blind SQL injection caused by unsanitized objid parameter in /actions/ajax.php used in userexists function, letting attackers perform blind SQL injection remotely, exploit requires crafted POST request. id: CVE-2026-21875 info: name: ClipBucket v5 = 5.5.2...

CVE-2026-77929

ClipBucket v5 before 5.5.3-182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile function in fileupload.class.php fails to update...

CVE-2026-77927

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the checkphoto parameter as an array to bypass the cleanrequests sanitization function in ClipBucket.class.php. Attackers can pass...

CVE-2026-77929 ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Upload Endpoint

ClipBucket v5 before 5.5.3-182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile function in fileupload.class.php fails to update...

EUVD-2026-82944

ClipBucket v5 before 5.5.3-182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile function in fileupload.class.php fails to update...

CVE-2026-77929 ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Upload Endpoint

ClipBucket v5 before 5.5.3-182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile function in fileupload.class.php fails to update...

CVE-2026-77929

ClipBucket v5 before version 5.5.3-#182 is affected by a remote code execution vulnerability in the FileUpload::manageFile() function (fileupload.class.php). The function fails to update the file extension after MIME validation, so an authenticated user can upload a PHP file carrying valid image ...

EUVD-2026-82938

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitting the msgid parameter as an array to bypass the cleanrequests sanitization function in ClipBucket.class.php. Attackers can pass unsanitize...

CVE-2026-77928

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection in the private message deletion endpoint. An authenticated attacker can bypass the clean_requests() sanitization in ClipBucket.class.php by submitting the msg_id parameter as an array , which passes unsanitized values through private_...

CVE-2026-77928 ClipBucket < 5.5.3-#182 Blind SQL Injection via Private Message Deletion Endpoint

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitting the msgid parameter as an array to bypass the cleanrequests sanitization function in ClipBucket.class.php. Attackers can pass unsanitize...

CVE-2026-77927 ClipBucket < 5.5.3-#182 Blind SQL Injection via Photo Deletion Endpoint

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the checkphoto parameter as an array to bypass the cleanrequests sanitization function in ClipBucket.class.php. Attackers can pass...

EUVD-2026-82933

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the checkphoto parameter as an array to bypass the cleanrequests sanitization function in ClipBucket.class.php. Attackers can pass...

CVE-2026-77927

ClipBucket v5 before 5.5.3-#182 is vulnerable to blind SQL injection via the photo deletion endpoint. Authenticated users can submit the check_photo parameter as an array, bypassing the clean_requests() sanitization function in ClipBucket.class.php. The unsanitized array elements flow through the...

CVE-2026-77927 ClipBucket < 5.5.3-#182 Blind SQL Injection via Photo Deletion Endpoint

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the checkphoto parameter as an array to bypass the cleanrequests sanitization function in ClipBucket.class.php. Attackers can pass...

CVE-2025-62429

CVE-2025-62429 PoC - clipbucket RCE 通过 updatelaunch.php 中的 PHP 代码注入实现 RCE 的概念验证（PoC） 披露： 最初由我通过 GHSA-3h9c-7j8r-xc3v 报告 ⚠️ 仅限授权渗透测试/研究用途。 漏洞信息...

CVE-2026-32321

CVE-2026-32321 CVE-2026-32321 | Clipbucket ブラインドSQLインジェクション...

CVE-2026-80138

ClipBucket V5's web installer fails to properly validate or escape the phpclifilepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious phpclifilepath value to execute arbitrary commands as the web server...

CVE-2026-80138 ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter

ClipBucket V5's web installer fails to properly validate or escape the phpclifilepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious phpclifilepath value to execute arbitrary commands as the web server...

CVE-2026-80138

ClipBucket V5 (versions 5.5.1 through 5.5.3-#153) is affected by an OS command injection in its web installer. The php_cli_filepath parameter is not properly validated or escaped before being passed to shell execution, allowing an unauthenticated attacker to submit a crafted POST request and exec...

CVE-2026-80138 ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter

ClipBucket V5's web installer fails to properly validate or escape the phpclifilepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious phpclifilepath value to execute arbitrary commands as the web server...