CVE-2026-103766

Name of the Vulnerable Software and Affected Versions ClipBucket versions 5 through 5.5.3-#197

Description Authenticated users with ad manager access permission can perform SQL injection via the delete parameter in the 'admin area/ads manager.php' endpoint. By using time-based blind payloads concatenated into AdsManager::DeleteAd() queries, attackers can extract user credentials and emails or modify and delete arbitrary records. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, allowing unauthorized access to the database.

Recommendations Update ClipBucket to a version later than 5.5.3-#197. As a temporary workaround, restrict access to the 'admin area/ads manager.php' endpoint or the delete parameter for users with ad manager access permission.