SQL Injection Vulnerability in ClipBucket 5.x
CVE-2026-21875

9.8CRITICAL

Key Information:

Vendor

Macwarrior

Status
Clipbucket-v5
Vendor
CVE Published:
7 January 2026

What is CVE-2026-21875?

ClipBucket is an open-source video sharing platform, and a vulnerability has been discovered in versions 5.5.2-#187 and earlier. This vulnerability allows attackers to execute Blind SQL Injection through the comment section of a channel. When a user submits a comment, a POST request is sent to the /actions/ajax.php endpoint. The obj_id parameter from this request is misused in the backend processing without sufficient validation or sanitization, making it possible for malicious inputs, such as '1' or '1=1--', to be included in SQL queries. This flaw could compromise the integrity of the application's database and potentially expose sensitive user information. Currently, no fix is available for this issue.

Affected Version(s)

clipbucket-v5 <= 5.5.2-#187

References

https://github.com/MacWarrior/clipbucket-v5/security/advi...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.