Reflected Cross-Site Scripting in ClipBucket v5 by MacWarrior
CVE-2026-110625

5.1MEDIUM

Key Information:

Vendor

Macwarrior

Status
Clipbucket-v5
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110625?

A reflected cross-site scripting vulnerability exists in ClipBucket versions up to v5.5.3-#206 that can be exploited via the unencoded type GET parameter in the admin_area/flagged_item.php script. Malicious actors can craft links directing logged-in administrators or moderators to flagged_item.php?type=, which, when accessed, allows the execution of injected scripts within the admin panel. This security flaw poses significant risks as it can lead to unauthorized actions or data leaks.

Affected Version(s)

clipbucket-v5 0 <= 5.5.3-#206

References

https://hackmd.io/@leediay/BJR_lh2ifg
third-party-advisory
https://github.com/MacWarrior/clipbucket-v5/blob/01990c0f...
technical-description
https://github.com/MacWarrior/clipbucket-v5/blob/01990c0f...
technical-description

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
.