CVE-2026-95812— ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters
Quick assessment
Affected
MacWarrior clipbucket-v5
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in thes
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-95812
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters
Source: CVE Program / CVE List V5
Vulnerability Description
ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary JavaScript in victims' browsers under the application origin.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MacWarrior | clipbucket-v5 | 0 ~ 5.5.3-#182 | - |
|
II. Public POCs for CVE-2026-95812
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-95812
请登录查看更多情报信息。
Other References for CVE-2026-95812 (2)
Other References for CVE-2026-95812 (4)
-
https://hackmd.io/@leediay/reflected-xss-in-search-function-clipbucket-v5 technical-description exploit
IV. Related Vulnerabilities
Same product: clipbucket-v5
-
CVE-2026-77929
ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Uplo -
CVE-2026-77928
ClipBucket < 5.5.3-#182 Blind SQL Injection via Private Mess -
CVE-2026-77927
ClipBucket < 5.5.3-#182 Blind SQL Injection via Photo Deleti -
CVE-2026-80138
ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection -
CVE-2026-49482
ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint
Same vendor: MacWarrior
-
CVE-2026-77929
ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Uplo -
CVE-2026-77928
ClipBucket < 5.5.3-#182 Blind SQL Injection via Private Mess -
CVE-2026-77927
ClipBucket < 5.5.3-#182 Blind SQL Injection via Photo Deleti -
CVE-2026-80138
ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection -
CVE-2026-49482
ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint
Same weakness: CWE-79
-
CVE-2026-77912
Stored cross-site scripting vulnerability in GitHub Enterpri -
CVE-2026-88020
Improper Neutralization of Input During Web Page Generation -
CVE-2026-76909
Unleash: CR-approval email renders user-controlled raw HTML -
CVE-2026-83801
Nautobot: Stored cross-site scripting (XSS) in object create -
CVE-2026-75744
Adobe Experience Manager Forms JEE | Cross-site Scripting (S
V. Comments for CVE-2026-95812
No comments yet