Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2026-102570: ClipBucket admin can alter database via language setting
CVE-2026-102570 · published 1 month ago
Summary
The ClipBucket video platform (versions 5 to 5.5.3‑#197) lets an administrator who can change basic settings modify the language setting in a way that runs unchecked database commands. This could let the admin view or change other data in the system. Limit admin rights to trusted users and apply the vendor’s update that fixes the language update handling.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| macwarrior | clipbucket-v5 | <= 5.5.3-#197 |
Original advisory text
ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter
ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basic_settings permission can inject arbitrary SQL payloads to extract or modify database contents.
References
- https://github.com/MacWarrior/clipbucket-v5 Product
- https://github.com/MacWarrior/clipbucket-v5/blob/f15cef1a2431786c31ffd79e81f55d6... Third Party Advisory
- https://hackmd.io/@leediay/two-blind-sqli-clickbucketv5-version_5_5_3_197 Exploit
- https://github.com/MacWarrior/clipbucket-v5/commit/ecbdf2d534ac7ef34a5a34e6e4c19... Patch
- https://www.vulncheck.com/advisories/clipbucket-v5-through-5.5.3-197-sql-injecti... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-1025... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-102570 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
8.1
High
Type
CWE-89SQL Injection
Timeline
Published29 Sep 2026
Updated4 Nov 2026
First seen29 Sep 2026
Track software like this
Free during beta