CVE-2026-77928

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection in the private message deletion endpoint. An authenticated attacker can bypass the clean_requests() sanitization in ClipBucket.class.php by submitting the msg_id parameter as an array , which passes unsanitized values through private_...