CVE-2026-95812

Received Received - Intake

Reflected XSS in ClipBucket v5

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: VulnCheck

Description

ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary JavaScript in victims' browsers under the application origin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-95812

Affected Vendors & Products

Vendor	Product	Version / Range
clipbucket	clipbucket	to 5.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

ClipBucket v5 before 5.5.3-#182 has a reflected cross-site scripting (XSS) vulnerability in the sort_link() function. It fails to properly sanitize the cat, sort, and time query parameters, allowing attackers to inject malicious JavaScript payloads via crafted URLs. When victims access these URLs, the script executes in their browsers under the application's origin.

Detection Guidance

Check for reflected XSS in ClipBucket v5 before 5.5.3-#182 by inspecting URLs for unsanitized cat, sort, or time parameters. Test with payloads like <script>alert(1)</script> in these parameters. Use browser developer tools or tools like Burp Suite to monitor responses for injected scripts.

Impact Analysis

This vulnerability allows attackers to steal session cookies, perform actions on your behalf, or redirect you to malicious sites. It can lead to unauthorized account access, data theft, or defacement of the ClipBucket application. Users may unknowingly execute harmful scripts while interacting with the site.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information if exploited. Organizations could face compliance violations, fines, or reputational damage due to insufficient protection against such attacks.

Mitigation Strategies

Upgrade ClipBucket to version 5.5.3-#182 or later to address the reflected XSS flaw. If immediate upgrade is not possible, implement input validation for cat, sort, and time parameters and apply output encoding to sanitize user-supplied data.

Hi! I’m here to help you understand CVE-2026-95812. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70