21 matches found
CVE-2026-110625
ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/flaggeditem.php via the unencoded type GET parameter. Attackers can send crafted flaggeditem.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel...
CVE-2026-110626
ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/languagesettings.php via the unencoded editlanguage GET parameter. Attackers can send administrators with basicsettings permission a crafted link whose payload is echoed into a hidden input,...
CVE-2026-110627
ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/index.php that allows attackers to inject HTML via the val parameter in mode=addtodo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...
EUVD-2026-101255
ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/index.php that allows attackers to inject HTML via the val parameter in mode=addtodo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...
CVE-2026-110627 ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter
ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/index.php that allows attackers to inject HTML via the val parameter in mode=addtodo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...
CVE-2026-110627
ClipBucket versions v5 through 5.5.3-#206 are vulnerable to a reflected cross-site scripting (XSS) vulnerability within the admin_area/index.php component. The root cause is the improper neutralization of input in the val parameter when mode=add_todo is used. An attacker can leverage this to inje...
CVE-2026-110627 ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter
ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/index.php that allows attackers to inject HTML via the val parameter in mode=addtodo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...
EUVD-2026-101254
ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/languagesettings.php via the unencoded editlanguage GET parameter. Attackers can send administrators with basicsettings permission a crafted link whose payload is echoed into a hidden input,...
EUVD-2026-101253
ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/flaggeditem.php via the unencoded type GET parameter. Attackers can send crafted flaggeditem.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel...
CVE-2026-110625 ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php
ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/flaggeditem.php via the unencoded type GET parameter. Attackers can send crafted flaggeditem.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel...
CVE-2026-110625
Versions v5 through 5.5.3-#206 of ClipBucket are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the admin_area/flagged_item.php file due to the lack of encoding on the type GET parameter. An attacker can distribute crafted links to logged-in administrators ...
CVE-2026-110625 ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php
ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/flaggeditem.php via the unencoded type GET parameter. Attackers can send crafted flaggeditem.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel...
EUVD-2026-91138
ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...
CVE-2026-103766
ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...
CVE-2026-103766: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...
CVE-2026-103766
ClipBucket versions v5 through 5.5.3-#197 are vulnerable to an SQL injection vulnerability. The issue resides in the admin_area/ads_manager.php file, where authenticated users with ad_manager_access permissions can inject SQL via the delete parameter . By supplying time-based blind payloads conca...
CVE-2026-103766 ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter
ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...
CVE-2026-42847: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - 122, there is a critical SQL Injection SQLi vulnerability in ClipBucket, exploitable through the type parameter on the authenticated admin endpoint adminarea/actionlogs.php. The endpoint adminarea/actionlogs.php reads...
CVE-2025-13545: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this vulnerability is an unknown functionality of the file /adminarea/index.php. The manipulation of the argument editpack leads to sql injection. The attack can be...