CVE-2026-77927

Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.3-#182

Description Authenticated users can extract arbitrary data from the database via a blind SQL injection. This occurs when the check photo parameter is submitted as an array, bypassing the clean requests() sanitization function in ClipBucket.class.php. Unsanitized array elements are passed through the bulk deletion handler in the 'manage photos.php' endpoint to the photo exists() function in photos.class.php, where non-numeric values are interpolated directly into a SQL query. This allows for time-based blind SQL injection, a technique that infers data by observing the time the server takes to respond to specific queries, to retrieve credential hashes and other sensitive information.

Recommendations Update to version 5.5.3-#182 or later. Avoid submitting the check photo parameter as an array in the 'manage photos.php' endpoint until the update is applied.