CVE-2025-64114

MEDIUM EPSS 27.1%
Published Nov 6, 20257mo ago · Modified Jun 17, 20261w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Nov 6, 2025 7mo ago
Last Modified Jun 17, 2026 1w ago

Description

ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - #151 and below allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database through its ClipBucket Custom Fields plugin. The vulnerabilities require the Custom Fields plugin to be installed and accessible, and can only be exploited by users with administrative access to the plugin interface. This issue is fixed in version 5.5.2 - #.

CVSS Details

Base Score
6.5
Exploitability
1.2
Impact
5.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
27.1% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-89 SQL Injection Injection

Affected Products 1

VendorProductVersionRange
oxygenzclipbucket*≥5.3  –  <5.5.2-152

References 3

  • github.com https://github.com/MacWarrior/clipbucket-v5/commit/b7289923177fe533ae908654ee3cd65b63ffb008
    Patch
  • github.com https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.2-%23152
    Release Notes
  • github.com https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-4g7x-j562-8g69
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/MacWarrior/clipbucket-v5/commit/b7289923177fe533ae908654ee3cd65b63ffb008
    Patch