CVE-2026-95812
ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 22, 2026
- Updated
- Oct 6, 2026
- Reserved
- Sep 22, 2026
Description
ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary JavaScript in victims' browsers under the application origin.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
clipbucket-v5MacWarrior |
|
References
- Patch Commitpatch
- clipbucket-v5 5.5.3-%23182 Release Notesrelease-notes
- sort_link() in upload/includes/functions.php at 5.5.3-#153technical-description
- Reporter write-uptechnical-descriptionexploit
- https://github.com/MacWarrior/clipbucket-v5product
- VulnCheck Advisory: ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parametersthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.