ClipBucket V5's web installer fails to properly validate or escape the phpclifilepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious phpclifilepath value to execute arbitrary commands as the web server user.

Multiple SQL injection vulnerabilities in ClipBucket 2.6 Revision 738 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) uid parameter in an addfriend action to ajax.php; id parameter in a (2) shareobject, (3) addtofav, (4) rating, or (5) flagobject action to ajax.php; cid parameter in an (6) addnewitem, (7) removecollectionitem, (8) getitem, or (9) loadmoreitems action to ajax.php; (10) ciid parameter in a getitem action to ajax.php; user parameter to (11) usercontacts.php or (12) viewchannel.php; (13) pid parameter to viewpage.php; (14) tid parameter to viewtopic.php; or (15) v parameter to watchvideo.php.

Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via (1) the collectiondescription parameter to upload/managecollections.php in an addnew action or the (2) photodescription, (3) phototags, or (4) phototitle parameter to upload/actions/photouploader.php.

SQL injection vulnerability in viewitem.php in ClipBucket 2.7 RC3 (2.7.0.4.v2929-rc3) allows remote attackers to execute arbitrary SQL commands via the item parameter.

Cross-site scripting (XSS) vulnerability in ClipBucket before 2.8.1 RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.