PT-2025-42637 · Unknown · Clipbucket

Publicado 2025-10-17 · Atualizado 2025-11-07 · CVE-2025-62430

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ClipBucket versions through 5.5.2 build #145

Description ClipBucket is an open source video sharing platform. Versions through build 5.5.2 #145 contain a stored cross-site scripting (XSS) issue in video and photo metadata fields. Specifically, the Tags field and the Genre, Actors, Producer, Executive Producer, and Director fields in Movieinfos for videos, and the Photo Title and Photo Tags fields for photos, accept user-supplied values without proper sanitization. A regular user with editing privileges can inject script that executes when any user views the affected video or photo page. The injected script can issue fetch requests to endpoints such as admin area pages and potentially exfiltrate their contents or trigger unintended actions.

Recommendations Update to ClipBucket version 5.5.2 build #146 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-62430

GHSA-QRQQ-HPF3-9MC9

Produtos afetados

Clipbucket

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62430.json · Exploit
• https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc · Correção
• https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-qrqq-hpf3-9mc9 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-62430 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1979256283787084067 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1979289023630766252 · Publicação no Twitter
• https://t.me/cveNotify/139234 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-62430 · Aviso do Fabricante
• https://t.me/cveNotify/142125 · Publicação no Telegram