CVE-2026-96272

Name of the Vulnerable Software and Affected Versions ClipBucket versions 5.x through 5.5.3-#182

Description An issue exists in the photo search endpoint search result.php where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. This allows unauthenticated attackers to use time-based blind SQL injection—a technique that infers data by observing the time the server takes to respond to specific queries—to extract user credentials, email addresses, and administrator password hashes for account takeover.

Recommendations Update ClipBucket to version 5.5.3-#182 or later.