CVE-2026-110625

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin area/flagged item.php via the unencoded type GET parameter. Attackers can send crafted flagged item.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel origin.