CVE-2025-64336

MEDIUM

ClipBucket 5.3-5.5.2-146 - Authenticated Stored Cross-Site Scripting via Photo Title

Title source: llm
STIX 2.1

Description

ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Photos feature is vulnerable to stored Cross-site Scripting (XSS). An authenticated regular user can upload a photo with a malicious Photo Title containing HTML/JavaScript code. While the payload does not execute in the user-facing photo gallery or detail pages, it is rendered unsafely in the Admin → Manage Photos section, resulting in JavaScript execution in the administrator’s browser. This issue is fixed in version 5.5.2-#147.

References (3)

Core 3

Scores

CVSS v3 5.4
EPSS 0.0025
EPSS Percentile 15.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-269 CWE-79
Status published
Products (1)
oxygenz/clipbucket 5.3 - 5.5.2-147
Published Nov 07, 2025
Tracked Since Feb 18, 2026