Oxygenz
Oxygenz Clipbucket: vulnerabilidades y CVE
Oxygenz Clipbucket tiene 25 vulnerabilidades publicadas, 18 de ellas en los últimos 12 meses. 6 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE25
Últimos 12 meses18
Críticas6
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-32321 | Alta (8.8) | 0.50% | — | 18 mar 2026 | ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 #80 within the `actions/ajax.php` endpoint. Due to insufficient… |
| CVE-2026-28354 | Media (5.7) | 0.32% | — | 27 feb 2026 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, collection item operations are vulnerable to authorization flaws, allowing a normal authenticated user to modify another user’s… |
| CVE-2026-26997 | Baja (2) | 0.26% | — | 27 feb 2026 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, a normal authenticated user can store the XSS payload. The payload is triggered by administrator. Version 5.5.3 #59 fixes the issue. |
| CVE-2026-26005 | Media (5) | 0.31% | — | 12 feb 2026 | ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #45, in Clip Bucket V5, The Remote Play allows creating video entries that reference external video URLs without uploading the video files to the… |
| CVE-2026-25728 | Crítica (9.3) | 0.41% | — | 10 feb 2026 | ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #40, a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability exists in ClipBucket's avatar and background image upload functionality.… |
| CVE-2026-21875 | Crítica (9.8) | 1.8% | — | 8 ene 2026 | ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#187 and below allow an attacker to perform Blind SQL Injection through the add comment section within a channel. When adding a comment within a… |
| CVE-2025-67418 | Crítica (9.8) | 0.51% | — | 22 dic 2025 | ClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded default administrative credentials. An unauthenticated remote attacker can log in to the… |
| CVE-2025-65113 | Media (6.5) | 0.40% | — | 29 nov 2025 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 - #164, an authorization bypass vulnerability in the AJAX flagging system allows any unauthenticated user to flag any content (users,… |
| CVE-2025-62709 | Alta (8.8) | 0.36% | — | 20 nov 2025 | ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build the server URL from the incoming HTTP Host header when the… |
| CVE-2025-64339 | Alta (7.2) | 0.25% | — | 7 nov 2025 | ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Playlists feature is vulnerable to stored Cross-site Scripting (XSS),specifically in the Playlist Name field. An… |
| CVE-2025-64336 | Alta (7.2) | 0.29% | — | 7 nov 2025 | ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Photos feature is vulnerable to stored Cross-site Scripting (XSS). An authenticated regular user can upload a photo… |
| CVE-2025-64338 | Media (5.1) | 0.49% | — | 7 nov 2025 | ClipBucket v5 is an open source video sharing platform. In versions 5.5.2 - #156 and below, an authenticated regular user can create a photo collection whose Collection Name contains HTML/JavaScript payloads, which… |
| CVE-2025-64114 | Media (6.5) | 0.39% | — | 6 nov 2025 | ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - #151 and below allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database through… |
| CVE-2025-62715 | Media (5.3) | 0.21% | — | 4 nov 2025 | ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#147 and below contain a stored Cross-Site Scripting (XSS) vulnerability in ClipBucket’s Collection tags feature. An authenticated normal user can… |
| CVE-2025-62429 | Alta (7.2) | 0.84% | — | 20 oct 2025 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 #147, ClipBucket v5 is vulnerable to arbitrary PHP code execution. In /upload/admin_area/actions/update_launch.php, the "type" parameter… |
| CVE-2025-62430 | Media (5.4) | 0.26% | — | 17 oct 2025 | ClipBucket v5 is an open source video sharing platform. ClipBucket v5 through build 5.5.2 #145 allows stored cross-site scripting (XSS) in multiple video and photo metadata fields. For videos the Tags field and the… |
| CVE-2025-62424 | Media (6.5) | 0.94% | — | 17 oct 2025 | ClipBucket is a web-based video-sharing platform. In ClipBucket version 5.5.2 - #146 and earlier, the /admin_area/template_editor.php endpoint is vulnerable to path traversal. The validation of the file-loading path is… |
| CVE-2025-62423 | Alta (7.2) | 0.52% | — | 16 oct 2025 | ClipBucket V5 provides open source video hosting with PHP. In version5.5.2 - #140 and earlier, a Blind SQL injection vulnerability exists in the Admin Area’s “/admin_area/login_as_user.php” file. Exploiting this… |
| CVE-2025-55912 | Alta (7.3) | 1.5% | — | 18 sept 2025 | An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php to upload arbitrary files without any authentication, due to missing access… |
| CVE-2025-55911 | Media (6.5) | 1.1% | — | 18 sept 2025 | An issue Clip Bucket v.5.5.2 Build#90 allows a remote attacker to execute arbitrary codes via the file_downloader.php and the file parameter |
| CVE-2025-21624 | Crítica (9.8) | 1.2% | — | 7 ene 2025 | ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 239, a file upload vulnerability exists in the Manage Playlist functionality of the application, specifically surrounding the uploading of… |
| CVE-2025-21623 | Alta (7.5) | 1.1% | — | 7 ene 2025 | ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 238, ClipBucket V5 allows unauthenticated attackers to change the template directory via a directory traversal, which results in a denial of… |
| CVE-2025-21622 | Crítica (9.1) | 0.96% | — | 7 ene 2025 | ClipBucket V5 provides open source video hosting with PHP. During the user avatar upload workflow, a user can choose to upload and change their avatar at any time. During deletion, ClipBucket checks for the avatar_url… |
| CVE-2024-54136 | Crítica (9.8) | 0.75% | — | 6 dic 2024 | ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/upload.php where the… |
| CVE-2024-54135 | Alta (8.8) | 0.75% | — | 6 dic 2024 | ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 2.0 to Version 5.5.1 Revision 199 are vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/photo_upload.php… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.