Reflected Cross-Site Scripting in ClipBucket by MacWarrior

CVE-2026-110626

What is CVE-2026-110626?

ClipBucket versions up to 5.5.3-#206 include a reflected cross-site scripting vulnerability found in admin_area/language_settings.php. This security flaw allows attackers to exploit an unencoded edit_language GET parameter, enabling them to relay crafted links to administrators with basic_settings permission. When these administrators access the malicious link, the payload is reflected into a hidden input field, executing unauthorized scripts within the context of the admin panel, thereby compromising the security of the application.

References