CVE-2026-45060
Received Received - Intake
Blind SQL Injection in ClipBucket Video Sharing Platform

Publication date: 2026-06-11

Last updated on: 2026-06-11

Assigner: GitHub, Inc.

Description
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter to execute SQL queries and exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #129.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-11
Last Modified
2026-06-11
Generated
2026-06-12
AI Q&A
2026-06-12
EPSS Evaluated
N/A
NVD
CVE-2026-45060
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
clipbucket clipbucket to 5.5.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in ClipBucket v5, an open source video sharing platform. Before version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to a blind SQL injection attack. An unauthenticated user can exploit the 'ids' parameter to execute arbitrary SQL queries on the database.

This allows the attacker to exfiltrate sensitive data from the database without authentication.

The vulnerability has been fixed in version 5.5.3 - #129.

Impact Analysis

This vulnerability can have severe impacts because it allows unauthenticated attackers to execute SQL queries and extract sensitive data from the database.

  • Compromise of confidential user data stored in the database.
  • Potential full compromise of the application’s data integrity and availability.
  • High risk of data breaches leading to loss of trust and possible legal consequences.

The CVSS score of 9.8 indicates a critical severity with high impact on confidentiality, integrity, and availability.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade ClipBucket to version 5.5.3 - #129 or later, where the blind SQL injection issue in the actions/progress_video.php endpoint has been patched.

Compliance Impact

The vulnerability in ClipBucket v5 prior to version 5.5.3 allows unauthenticated users to perform blind SQL injection via the ids parameter, potentially leading to the exfiltration of sensitive data.

Such unauthorized access and data exfiltration could result in non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding sensitive personal and health information against unauthorized access and breaches.

Therefore, if exploited, this vulnerability could lead to violations of these standards due to compromised confidentiality, integrity, and availability of sensitive data.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45060. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart