CVE-2026-102570

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basic settings permission can inject arbitrary SQL payloads to extract or modify database contents.