Reflected Cross-Site Scripting in ClipBucket by MacWarrior
CVE-2026-110627

2.1LOW

Key Information:

Vendor

Macwarrior

Status
Clipbucket-v5
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110627?

A reflected cross-site scripting vulnerability exists in ClipBucket versions 5.0 to 5.5.3-#206, specifically within the admin_area/index.php file. This flaw allows attackers to inject malicious HTML through the 'val' parameter when using the 'mode=add_todo' functionality. By tricking a logged-in administrator into submitting a crafted POST request, attackers can execute arbitrary scripts within the admin panel's context. This situation arises due to the lack of proper CSRF protection and improper encoding, which can lead to severe security implications.

Affected Version(s)

clipbucket-v5 0 <= 5.5.3-#206

References

https://hackmd.io/@leediay/BJR_lh2ifg
third-party-advisory
https://github.com/MacWarrior/clipbucket-v5/blob/01990c0f...
technical-description
https://github.com/MacWarrior/clipbucket-v5/commit/b25185...
patch

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
.