CVE-2026-21875: ClipBucket v5 Vulnerable to Blind SQL Injection through Channel Comments
ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#187 and below allow an attacker to perform Blind SQL Injection through the add comment section within a channel. When adding a comment within a channel, there is a POST request to the /actions/ajax.php endpoint. The objid parameter within the POST request to /actions/ajax.php is then used within the userexists function of the upload/includes/classes/user.class. php file as the $id parameter. It is then used within the count function of the upload/includes/classes/db.class. php file. The $id parameter is concatenated into the query without validation or sanitization, and a user-supplied input like 1' or 1=1-- - can be used to trigger the injection. This issue does not have a fix at the time of publication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21875?
CVE-2026-21875 is rated as a critical vulnerability due to its potential for Blind SQL Injection, which can compromise user data and application integrity.
How do I fix CVE-2026-21875?
To fix CVE-2026-21875, upgrade to ClipBucket version 5.5.2-#188 or later, which addresses the SQL injection vulnerability.
What are the potential impacts of exploiting CVE-2026-21875?
Exploiting CVE-2026-21875 could allow an attacker to execute malicious SQL queries, leading to unauthorized data access or altering of the database.
Which versions of ClipBucket are affected by CVE-2026-21875?
ClipBucket versions 5.5.2-#187 and below are affected by CVE-2026-21875.
What type of vulnerability is CVE-2026-21875?
CVE-2026-21875 is classified as a Blind SQL Injection vulnerability that can be exploited through comment submission on a channel.