CVE-2026-32321: ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration
ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 #80 within the actions/ajax.php endpoint. Due to insufficient input sanitization of the userid parameter, an authenticated attacker can execute arbitrary SQL queries, leading to full database disclosure and potential administrative account takeover. Version 5.5.3 #80 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32321?
CVE-2026-32321 is classified as a critical vulnerability due to its potential for data exfiltration.
How do I fix CVE-2026-32321?
To fix CVE-2026-32321, upgrade ClipBucket to version 5.5.3 or later, where the vulnerability is patched.
What type of vulnerability is CVE-2026-32321?
CVE-2026-32321 is a time-based Blind SQL Injection vulnerability.
Where is CVE-2026-32321 located in the code?
CVE-2026-32321 is located in the `actions/ajax.php` endpoint of ClipBucket.
Who is affected by CVE-2026-32321?
Users of ClipBucket versions prior to 5.5.3 are affected by CVE-2026-32321.