PT-2025-42637 · Unknown · Clipbucket

Published 2025-10-17 · Updated 2025-11-07 · CVE-2025-62430

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ClipBucket versions through 5.5.2 build #145

Description ClipBucket is an open source video sharing platform. Versions through build 5.5.2 #145 contain a stored cross-site scripting (XSS) issue in video and photo metadata fields. Specifically, the Tags field and the Genre, Actors, Producer, Executive Producer, and Director fields in Movieinfos for videos, and the Photo Title and Photo Tags fields for photos, accept user-supplied values without proper sanitization. A regular user with editing privileges can inject script that executes when any user views the affected video or photo page. The injected script can issue fetch requests to endpoints such as admin area pages and potentially exfiltrate their contents or trigger unintended actions.

Recommendations Update to ClipBucket version 5.5.2 build #146 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62430

GHSA-QRQQ-HPF3-9MC9

Affected Products

Clipbucket

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62430.json · Exploit
• https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc · Patch
• https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-qrqq-hpf3-9mc9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62430 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62430 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1979256283787084067 · Twitter Post
• https://twitter.com/CVEnew/status/1979289023630766252 · Twitter Post
• https://t.me/cveNotify/139234 · Telegram Post
• https://t.me/cveNotify/142125 · Telegram Post