ClipBucket version 5 allows authenticated users with video‑upload privileges to add and rename subtitle files. The POST /actions/subtitle_edit.php endpoint uses a number parameter that is vulnerable to boolean‑based blind SQL injection. By repeatedly querying this endpoint a malicious user can extract arbitrary database content, exposing sensitive data and potentially undermining data integrity. The flaw does not enable code execution, but it does provide unauthorized data disclosure.

MacWarrior:clipbucket-v5, all releases prior to version 5.5.3 – #132. The defect was remediated in that release.

The CVSS score of 8.8 marks this vulnerability as high severity. EPSS information is unavailable, so the precise exploitation probability cannot be quantified, yet the presence of a standard SQL injection indicates a tangible risk. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated account with upload rights, and the attacker must perform a series of Boolean‑based requests to retrieve data.