Vulnerability · Published Nov 5, 2025 · Assigned by GitHub_M

CVE-2025-64114ClipBucket v5: SQL Injection possible through ClipBucket Custom Fields plugin

Medium 6.5

In plain English

A medium-severity SQL injection in clipbucket-v5 from MacWarrior. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 63.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - #151 and below allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database through its ClipBucket Custom Fields plugin. The vulnerabilities require the Custom Fields plugin to be installed and accessible, and can only be exploited by users with administrative access to the plugin interface. This issue is fixed in version 5.5.2 - #.

Affected products (as reported)

Vendor	Product	Versions
MacWarrior	clipbucket-v5	< 5.5.2-#152

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-4g7x-j562-8g69 x_refsource_CONFIRM
https://github.com/MacWarrior/clipbucket-v5/commit/b7289923177fe533ae908654ee3cd65b63ffb008 x_refsource_MISC
https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.2-%23152 x_refsource_MISC