CVE-2025-64338Critical· 9.0▾ MidnightClipBucket v5 is an open source video sharing platform. In versions 5.5.2 - #156 and below, an authenticated regular user can create a photo collection whose Collection Name contains HTML/JavaScript payloads, which making ClipBucket’s Ma…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 49.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Last analysed / modified upstream
ClipBucket v5 is an open source video sharing platform. In versions 5.5.2 - #156 and below, an authenticated regular user can create a photo collection whose Collection Name contains HTML/JavaScript payloads, which making ClipBucket’s Manage Photos feature vulnerable to Stored XSS. The payload is rendered unsafely in the Admin → Manage Photos interface, causing it to execute in the administrator’s browser, therefore allowing an attacker to target administrators and perform actions with elevated privileges. This issue is fixed in version 5.5.2 - #157.
clipbucket >= 5.3, < 5.5.2-157Upgrade past the affected range:
clipbucket 5.5.2-157Connected by shared product, vendor, weakness, or advisory.
CVE-2025-62430Medium· 5.4ClipBucket v5 is an open source video sharing platform
CVE-2025-62424Medium· 6.7ClipBucket is a web-based video-sharing platform
CVE-2025-62423Medium· 6.7ClipBucket V5 provides open source video hosting with PHP
CVE-2025-62429High· 7.2ClipBucket v5 is an open source video sharing platform
CVE-2025-64114Medium· 6.5ClipBucket v5 is an open source video sharing platform
CVE-2025-65113Medium· 6.5ClipBucket v5 is an open source video sharing platform