PT-2026-114069

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in admin area/index.php that allows attackers to inject HTML via the val parameter in mode=add todo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...