Advisories · Technology
MacWarrior clipbucket-v5.
Every CVE that names MacWarrior clipbucket-v5 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 2.1 Low
ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter
- MacWarrior clipbucket-v5
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php
- MacWarrior clipbucket-v5
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php
- MacWarrior clipbucket-v5
- Cross-site scripting (XSS)
- CVSS 8.6 High
ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter
- MacWarrior clipbucket-v5
- SQL injection
- CVSS 7.0 High
ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter
- MacWarrior clipbucket-v5
- SQL injection
- CVSS 7.0 High
ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter
- MacWarrior clipbucket-v5
- SQL injection
- CVSS 8.6 High
ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.php
- MacWarrior clipbucket-v5
- Path traversal
- CVSS 8.7 High
ClipBucket v5 before 5.5.3-#182 SQL Injection via search_result.php
- MacWarrior clipbucket-v5
- SQL injection
- CVSS 5.3 Medium
ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters
- MacWarrior clipbucket-v5
- Cross-site scripting (XSS)
- CVSS 8.7 High
ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Upload Endpoint
- MacWarrior clipbucket-v5
- Unrestricted file upload
- CVSS 7.1 High
ClipBucket < 5.5.3-#182 Blind SQL Injection via Private Message Deletion Endpoint
- MacWarrior clipbucket-v5
- SQL injection
- CVSS 7.1 High
ClipBucket < 5.5.3-#182 Blind SQL Injection via Photo Deletion Endpoint
- MacWarrior clipbucket-v5
- SQL injection
- CVSS 9.2 CriticalCritical · CVSS 9+
ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter
- MacWarrior clipbucket-v5
- Command injection
- CVSS 4.3 Medium
ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint Allows Mass Subtitle Overwrite
- MacWarrior clipbucket-v5
- Other injection
- CWE-155
- CVSS 6.5 Medium
ClipBucket: IDOR in videos subtitle editor
- MacWarrior clipbucket-v5
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
ClipBucket: Blind SQL Injection in progress_video.php
- MacWarrior clipbucket-v5
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
ClipBucket: Remote Play URL Command Injection
- MacWarrior clipbucket-v5
- Command injection
- CVSS 8.8 High
ClipBucket: Blind SQL Injection in subtitle_edit.php
- MacWarrior clipbucket-v5
- SQL injection
- CVSS 7.1 High
ClipBucket: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- MacWarrior clipbucket-v5
- SQL injection
- CVSS 8.8 High
ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration
- MacWarrior clipbucket-v5
- SQL injection
- CVSS 5.7 Medium
ClipBucket v5 has IDOR in Collection Item Management
- MacWarrior clipbucket-v5
- Broken access control
- CVSS 2.0 Low
ClipBucket v5 has Stored XSS via Collection name
- MacWarrior clipbucket-v5
- Cross-site scripting (XSS)
- CVSS 5.0 Medium
ClipBucket v5 enables internal network scans via an SSRF vulnerability
- MacWarrior clipbucket-v5
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
ClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race Condition
- MacWarrior clipbucket-v5
- Race condition
- CVSS 9.8 CriticalCritical · CVSS 9+
ClipBucket v5 Vulnerable to Blind SQL Injection through Channel Comments
- MacWarrior clipbucket-v5
- SQL injection
- CVSS 5.1 Medium
ClipBucket's Manage Photos Feature is Vulnerable to Stored XSS via Collection Name
- MacWarrior clipbucket-v5
- Cross-site scripting (XSS)
- Privilege escalation
- CVSS 6.5 Medium
ClipBucket v5 Unauthenticated Object Flagging Vulnerability
- MacWarrior clipbucket-v5
- Denial of service
- CVSS 6.8 Medium
ClipBucket v5 is vulnerable to password reset link manipulation
- MacWarrior clipbucket-v5
- CWE-640
- CVSS 7.2 High
ClipBucket v5: Stored XSS Vulnerability in Manage Playlists
- MacWarrior clipbucket-v5
- Cross-site scripting (XSS)
- CVSS 7.2 High
ClipBucket v5's Manage Photo Feature is Vulnerable to Stored XSS Attack via Photo Title
- MacWarrior clipbucket-v5
- Cross-site scripting (XSS)
- Privilege escalation
- CVSS 6.5 Medium
ClipBucket v5: SQL Injection possible through ClipBucket Custom Fields plugin
- MacWarrior clipbucket-v5
- SQL injection
- CVSS 5.3 Medium
ClipBucket v5: Stored XSS via Collection Tags
- MacWarrior clipbucket-v5
- Cross-site scripting (XSS)
- CVSS 7.2 High
ClipBucket v5 executes arbitrary PHP code
- MacWarrior clipbucket-v5
- Code injection
- CVSS 5.4 Medium
ClipBucket v5 stored XSS via video/photo fields
- MacWarrior clipbucket-v5
- Cross-site scripting (XSS)
- CVSS 6.7 Medium
ClipBucket path traversal vulnerability in template editor allows arbitrary file read and write
- MacWarrior clipbucket-v5
- Path traversal
- CVSS 6.7 Medium
ClipBucket V5 Blind SQL injection in the Admin Panel
- MacWarrior clipbucket-v5
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
ClipBucket V5 Playlist Cover File Upload to Remote Code Execution
- MacWarrior clipbucket-v5
- Unrestricted file upload
- CVSS 7.5 High
ClipBucket V5 Unauthenticated Template Directory Update to Denial-of-Service
- MacWarrior clipbucket-v5
- Path traversal
- Authentication bypass
- CVSS 7.5 High
ClipBucket V5 Avatar URL Path Traversal to Arbitrary File Delete
- MacWarrior clipbucket-v5
- Path traversal
- CVSS 9.8 CriticalCritical · CVSS 9+
Untrusted Deserialization in ClipBucket-v5 Version 2.0 to 5.5.1 Revision 199
- MacWarrior clipbucket-v5
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
Untrusted Deserialization in ClipBucket-v5 Version 5.5.1 Revision 199 and Below
- MacWarrior clipbucket-v5
- Insecure deserialization