CVE-2026-45060

Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.3 - #129

Description An unauthenticated blind SQL injection exists in the 'actions/progress video.php' endpoint. This allows an attacker to execute SQL queries and exfiltrate sensitive data by manipulating the ids parameter. Blind SQL injection is a technique where an attacker asks the database true or false questions and determines the answer based on the application's response.

Recommendations Update to version 5.5.3 - #129. As a temporary workaround, restrict access to the 'actions/progress video.php' endpoint or avoid using the ids parameter until the update is applied.