PT-2025-45168 · Clipbucket+1 · Clipbucket Custom Fields Plugin+1

Published 2025-11-05 · Updated 2025-11-10 · CVE-2025-64114

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ClipBucket versions 5.5.2 and below

Description ClipBucket v5 is a video sharing platform. Versions 5.5.2 and below allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database through the ClipBucket Custom Fields plugin. Exploitation requires the Custom Fields plugin to be installed and accessible, and is limited to users with administrative access to the plugin interface. The vulnerable component is the ClipBucket Custom Fields plugin.

Recommendations Versions prior to 5.5.2 should be updated to version 5.5.2 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-64114

GHSA-4G7X-J562-8G69

Affected Products

Clipbucket

Clipbucket Custom Fields Plugin

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64114.json · Exploit
• https://github.com/MacWarrior/clipbucket-v5/commit/b7289923177fe533ae908654ee3cd65b63ffb008 · Patch
• https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-4g7x-j562-8g69 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64114 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64114 · Security Note
• https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.2-%23152 · Note
• https://t.me/cveNotify/141885 · Telegram Post
• https://t.me/CVEtracker/36655 · Telegram Post
• https://t.me/cveNotify/142324 · Telegram Post