The vulnerability is a reflected cross‑site scripting flaw in the ClipBucket v5 admin interface, specifically the add_todo endpoint. An attacker can embed arbitrary HTML or JavaScript in the val parameter. When a logged‑in administrator submits a crafted POST request without CSRF protection, the injected code executes within the admin panel origin.

The affected product is ClipBucket v5, versions up to and including 5.5.3‑#206, sold by MacWarrior. The flaw resides in the admin_area/index.php file of these releases.

The CVSS score of 2.1 indicates low severity. No EPSS data is available and the flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to trick a logged‑in administrator into submitting a malicious POST form, which is straightforward once the target interacts. The injected script runs with the administrator’s privileges within the admin panel, limiting the impact to the administrator’s browser session.