CVE-2026-110625: ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php

Q: Who is exposed to this issue?

Logged-in ClipBucket administrators and moderators who open a crafted link to admin_area/flagged_item.php are exposed. The injected script executes in the admin panel origin, so it can act in the context of the targeted user's session.

Q: What does an attacker need to exploit it?

An attacker only needs to craft a URL with a malicious value in the type GET parameter and convince a logged-in administrator or moderator to open it. No attacker authentication is indicated, but user interaction is required.

Q: Which versions are affected?

The affected range is ClipBucket v5 through 5.5.3-#206.

Published Oct 14, 2026

Updated

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in adminarea/flaggeditem.php via the unencoded type GET parameter. Attackers can send crafted flaggeditem.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel origin.

Affected Software

1 affected component

ClipBucket ClipBucket>=5<=5.5.3-#206

Event History

Oct 14, 2026

CVE Published

via MITRE·02:17 PM

Data Sourced

via MITRE·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Logged-in ClipBucket administrators and moderators who open a crafted link to admin_area/flagged_item.php are exposed. The injected script executes in the admin panel origin, so it can act in the context of the targeted user's session.

What does an attacker need to exploit it?

An attacker only needs to craft a URL with a malicious value in the type GET parameter and convince a logged-in administrator or moderator to open it. No attacker authentication is indicated, but user interaction is required.

Which versions are affected?