CVE-2026-77927 — ClipBucket < 5.5.3-#182 Blind SQL Injection via Photo Deletion Endpoint
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the check_…
Published: 2026-09-18 · CVSS: 7.1 · CVSS 4.0
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the check_photo parameter as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php. Attackers can pass unsanitized array elements through the bulk deletion handler in manage_photos.php to photo_exists() in photos.class.php, where non-numeric values are interpolated directly into a SQL query, enabling time-based blind SQL injection to retrieve credential hashes and other sensitive data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7