CVE-2026-96272 — ClipBucket v5 before 5.5.3-#182 SQL Injection via search_result.php
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDE…
Published: 2026-09-23 · CVSS: 8.7 · CVSS 4.0
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials, email addresses, and administrator password hashes for account takeover.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7