Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.9

ClipBucket photo manager lets admin run malicious code

CVE-2025-64336 · published 11 months ago
Summary

In ClipBucket version 5 (up to 5.5.2-#146), a regular user can give a photo a title that contains hidden code. When an administrator later opens the Manage Photos page, that code runs in the admin’s browser, potentially letting the attacker take actions as the admin. Update to version 5.5.2-#147 or later to stop this from happening.

What to do
  • Update oxygenz clipbucket to version 5.5.2-147 or later.
Affected software
VendorProductAffected versions
oxygenz clipbucket >= 5.3, < 5.5.2-147
cpe:2.3:a:oxygenz:clipbucket:*:*:*:*:*:*:*:*
Original advisory text
ClipBucket v5's Manage Photo Feature is Vulnerable to Stored XSS Attack via Photo Title
ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Photos feature is vulnerable to stored Cross-site Scripting (XSS). An authenticated regular user can upload a photo with a malicious Photo Title containing HTML/JavaScript code. While the payload does not execute in the user-facing photo gallery or detail pages, it is rendered unsafely in the Admin → Manage Photos section, resulting in JavaScript execution in the administrator’s browser. This issue is fixed in version 5.5.2-#147.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.9 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
CWE-269Improper Privilege Management
Timeline
Published7 Nov 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-64336 · NVD
CVE-2025-64336 · OSV
GHSA-hjc2-5329-j49w · GHSA
Track software like this
Free during beta