Description
ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries to extract user credentials and emails or modify and delete arbitrary records.
Published: 2026-10-01
Score: 8.6 High
EPSS: n/a
KEV: No
Impact: Data Theft and Modification
Action: Apply Patch
AI Analysis

Impact

Authenticated users with ad_manager_access permission can supply arbitrary SQL code via the delete parameter in admin_area/ads_manager.php, which is directly concatenated into the AdsManager::DeleteAd queries. The vulnerability allows attackers to read user credentials and emails, modify or delete records, and generally tamper with the database.

Affected Systems

The affected product is ClipBucket version 5 and all releases up to 5.5.3-#197, distributed by MacWarrior. These versions use the oxygenz:clipbucket platform, and any installation within this version range must be assessed for the vulnerability.

Risk and Exploitability

The CVSS score of 8.6 marks a high severity, while no EPSS data is available and the issue is not yet listed in the CISA KEV catalog. Attackers require legitimate access with ad_manager_access privileges, but the time‑based blind injection technique can be used to exfiltrate data or alter database contents. The lack of an EPSS score suggests limited public exploitation at this time, but the high CVSS indicates a serious risk if exploited.

Generated by OpenCVE AI on October 2, 2026 at 00:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ClipBucket to a version later than 5.5.3-#197 where the deletion SQL injection has been corrected.
  • If an upgrade is not immediately possible, revoke the ad_manager_access permission from all non‑administrative users or disable the delete function entirely.
  • Deploy a web application firewall or input‑validation filter to block malicious SQL patterns targeting the delete parameter in ads_manager.php.

Generated by OpenCVE AI on October 2, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Macwarrior
Macwarrior clipbucket-v5
Vendors & Products Macwarrior
Macwarrior clipbucket-v5

Thu, 01 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Description ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries to extract user credentials and emails or modify and delete arbitrary records.
Title ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter
First Time appeared Oxygenz
Oxygenz clipbucket
Weaknesses CWE-89
CPEs cpe:2.3:a:oxygenz:clipbucket:*:*:*:*:*:*:*:*
Vendors & Products Oxygenz
Oxygenz clipbucket
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Macwarrior Clipbucket-v5
Oxygenz Clipbucket
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-01T23:20:00.160Z

Reserved: 2026-10-01T10:39:47.845Z

Link: CVE-2026-103766

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-02T00:16:59.820

Modified: 2026-10-02T00:16:59.820

Link: CVE-2026-103766

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T00:45:07Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')