ClipBucket v5 to 5.5.3-#197 contains a time‑based blind SQL injection in the admin video edit feature. The videoid parameter is concatenated directly into an UPDATE statement without escaping. An attacker who is an authenticated administrator with video_moderation rights can inject arbitrary SQL, enabling extraction or modification of database data, which compromises confidentiality and integrity and could allow complete takeover of the underlying database.

All installations of MacWarrior’s ClipBucket v5 up through version 5.5.3‑#197 are vulnerable. This includes any build of v5.0 to v5.5.3‑#197 released by MacWarrior.

With a CVSS score of 7, the vulnerability is considered moderate to high severity. The exploit requires authentication as an administrator who holds the video_moderation permission; it is a time‑based blind SQL injection, meaning no immediate error output is needed, but it requires a response latency measurement. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalogue, so it is not known to be actively exploited in the wild, but the potential for significant database compromise exists if an attacker gains admin privileges.