PT-2025-45407 · Unknown · Clipbucket

Published 2025-11-07 · Updated 2025-12-05 · CVE-2025-64336

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ClipBucket versions 5.5.2-#146 and below

Description ClipBucket is a video sharing platform. A stored Cross-site Scripting (XSS) issue exists in the Manage Photos feature. An authenticated regular user can upload a photo with a malicious Photo Title containing HTML/JavaScript code. This code is rendered unsafely in the Admin → Manage Photos section, leading to JavaScript execution in the administrator’s browser. The Photo Title is the vulnerable parameter.

Recommendations Update to ClipBucket version 5.5.2-#147.

Exploit

Fix

Improper Privilege Management

XSS

Weakness Enumeration

CWE-269

CWE-79

Related Identifiers

CVE-2025-64336

GHSA-HJC2-5329-J49W

Affected Products

Clipbucket

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64336.json · Exploit
• https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc · Patch
• https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-hjc2-5329-j49w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64336 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64336 · Security Note
• https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.2-%23147 · Note
• https://twitter.com/VulmonFeeds/status/1986731383973097472 · Twitter Post
• https://twitter.com/CVEnew/status/1986655897859596462 · Twitter Post
• https://t.me/cveNotify/144949 · Telegram Post
• https://t.me/CVEtracker/36746 · Telegram Post
• https://twitter.com/offseq/status/1986720563071525274 · Twitter Post