Description
ClipBucket V5 provides open source video hosting with PHP. In version5.5.2 - #140 and earlier, a Blind SQL injection vulnerability exists in the Admin Area’s “/admin_area/login_as_user.php” file. Exploiting this vulnerability requires access privileges to the Admin Area.
Affected products
oxygenz: clipbucket
References3
- github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-3w… ExploitVendor Advisory
- github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-3w… ExploitVendor Advisory
- github.com/MacWarrior/clipbucket-v5/commit/b3bf27e367f318c2afe9… Patch
Metrics
- CVSS 3.1
-
7.2
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 44 · as of 9 November 2026
- CWE
- CWE-89
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.