CVE-2026-103766: ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter
ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries to extract user credentials and emails or modify and delete arbitrary records.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated and have the ad_manager_access permission. Unauthenticated users and authenticated users without that permission are not described as able to exploit it.
What access can exploitation provide?
An attacker can use time-based blind SQL injection to extract user credentials and email addresses. The vulnerability can also be used to modify or delete arbitrary database records.
Which deployments are affected?
ClipBucket v5 through 5.5.3-#197 are affected. The issue is in the delete parameter handled by admin_area/ads_manager.php.