CVE-2026-110625

Deferred Deferred - Pending Action

Reflected XSS in ClipBucket Admin Panel via type Parameter

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter. Attackers can send crafted flagged_item.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel origin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110625

EUVD

EUVD-2026-101253

Affected Vendors & Products

Vendor	Product	Version / Range
MacWarrior	clipbucket-v5	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

ClipBucket v5 through 5.5.3-#206 has a reflected cross-site scripting (XSS) vulnerability in the admin_area/flagged_item.php file. The 'type' GET parameter is reflected without proper encoding, allowing attackers to inject malicious scripts via crafted links sent to administrators or moderators. This can execute arbitrary JavaScript in the admin panel's origin.

Detection Guidance

To detect this reflected XSS vulnerability in ClipBucket v5 through 5.5.3-#206, inspect the flagged_item.php file for improper handling of the 'type' GET parameter. Check if user input is reflected without encoding in the page or scripts. Review the admin_area/flagged_item.php and flagged_item.html files for unescaped output of the 'type' parameter.

Impact Analysis

Attackers can trick logged-in administrators or moderators into clicking malicious links, enabling them to perform actions on behalf of victims, access sensitive information, modify displayed content, conduct phishing attacks, or compromise higher-privileged sessions. This could lead to unauthorized access or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance with these regulations.

Mitigation Strategies

Apply context-appropriate output encoding to the 'type' parameter in flagged_item.php. Validate input against allowed flag element types using Flag::getFlagElementTypes(). Implement a Content Security Policy (CSP) to mitigate XSS risks. Consider applying the unmerged pull request #936 from GitHub as a temporary fix.

Hi! I’m here to help you understand CVE-2026-110625. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70