CVE-2026-21875 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-89 (SQL Injection). ❌ **Flaw**: The `obj_id` parameter in `/actions/ajax.php` is **not validated or sanitized**. Malicious input bypasses security checks directly.

Q: Who is affected? (Versions/Components)

📦 **Affected**: MacWarrior's **ClipBucket v5**. 📅 **Version**: Specifically **5.5.2-#187** and all prior versions. 🌐 **Type**: Open-source PHP script for video sharing sites.

Q: Is exploitation threshold high? (Auth/Config)

🔓 **Threshold**: **LOW**. 🚫 **Auth**: No authentication required (`PR:N`). 🌐 **Network**: Remote exploitation (`AV:N`). 👀 **UI**: No user interaction needed (`UI:N`). Easy to exploit!

Q: Is there a public Exp? (PoC/Wild Exploitation)

🚫 **Public Exploit**: **None listed** in current data (`pocs: []`). ⚠️ **Status**: While no public PoC is attached, the vulnerability type (Blind SQLi) is well-known. Exploitation tools likely exist in the wild.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Scan for `/actions/ajax.php` endpoint. 2. Test `obj_id` parameter with SQL injection payloads (e.g., `' OR 1=1--`). 3. Look for time-based delays or error responses indicating Blind SQLi.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. 📈 **CVSS**: High (9.8/10 implied by H/I/H). ⚡ **Priority**: Patch immediately. Remote, unauthenticated exploitation makes this a high-priority target for attackers.

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Blind SQL Injection in ClipBucket v5.5.2-#187 and earlier. <br>📉 **Consequences**: Attackers can extract database content via the `/actions/ajax.php` endpoint.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-89 (SQL Injection). <br>❌ **Flaw**: The `obj_id` parameter in `/actions/ajax.php` is **not validated or sanitized**. Malicious input bypasses security checks directly.

Q3Who is affected? (Versions/Components)

📦 **Affected**: MacWarrior's **ClipBucket v5**. <br>📅 **Version**: Specifically **5.5.2-#187** and all prior versions. <br>🌐 **Type**: Open-source PHP script for video sharing sites.

Q4What can hackers do? (Privileges/Data)

💀 **Attacker Capabilities**: <br>🔓 **Access**: Full database read/write potential. <br>👑 **Privileges**: High (CVSS H).…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

🔓 **Threshold**: **LOW**. <br>🚫 **Auth**: No authentication required (`PR:N`). <br>🌐 **Network**: Remote exploitation (`AV:N`). <br>👀 **UI**: No user interaction needed (`UI:N`). Easy to exploit!

Q6Is there a public Exp? (PoC/Wild Exploitation)

🚫 **Public Exploit**: **None listed** in current data (`pocs: []`). <br>⚠️ **Status**: While no public PoC is attached, the vulnerability type (Blind SQLi) is well-known. Exploitation tools likely exist in the wild.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: <br>1. Scan for `/actions/ajax.php` endpoint. <br>2. Test `obj_id` parameter with SQL injection payloads (e.g., `' OR 1=1--`). <br>3. Look for time-based delays or error responses indicating Blind SQLi.

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Fix Status**: **Yes**. <br>🔗 **Source**: Official GitHub Advisory [GHSA-crpv-fmc4-j392](https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-crpv-fmc4-j392).…

Read full answer (login)

Q9What if no patch? (Workaround)

🛡️ **No Patch Workaround**: <br>1. **WAF**: Block SQL keywords in `obj_id` parameter. <br>2. **Input Validation**: Strictly whitelist integer values for `obj_id`. <br>3.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. <br>📈 **CVSS**: High (9.8/10 implied by H/I/H). <br>⚡ **Priority**: Patch immediately. Remote, unauthenticated exploitation makes this a high-priority target for attackers.

Continue exploring

Vulnerability detail Full AI analysis (login) MacWarrior CWE-89