Vulnerability · Published Sep 29, 2026 · Assigned by VulnCheck
CVE-2026-102569ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter
Medium 5.5
In plain English
A medium-severity SQL injection in clipbucket-v5 from MacWarrior. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.3%top 78.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with video_moderation permission can inject arbitrary SQL commands to extract or modify database contents.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MacWarrior | clipbucket-v5 | 0 – through 5.5.3-#197 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
References
- https://github.com/MacWarrior/clipbucket-v5/commit/1c30d0b0e093ecfc656c98758707352abb2fc6ab patch
- https://github.com/MacWarrior/clipbucket-v5/blob/f15cef1a2431786c31ffd79e81f55d6eeca4ebc0/upload/includes/classes/video.class.php#L1972 technical-description
- https://hackmd.io/@leediay/two-blind-sqli-clickbucketv5-version_5_5_3_197 exploit
- https://github.com/MacWarrior/clipbucket-v5 product
- VulnCheck Advisory: ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter third-party-advisory