Blind SQL Injection Vulnerability in ClipBucket by MacWarrior

CVE-2026-77928

What is CVE-2026-77928?

ClipBucket versions prior to 5.5.3-#182 contain a vulnerability that allows authenticated users to execute a blind SQL injection attack. By manipulating the msg_id parameter and bypassing the clean_requests() sanitization function, attackers can send unsanitized data through the deletion handler in private_message.php. This leads to interpolation of unescaped message IDs into SQL queries. The exploit can allow attackers to retrieve sensitive information including user credential hashes and email addresses, significantly compromising user privacy and security.

References