PT-2025-45408 · Unknown · Clipbucket

Published 2025-11-07 · Updated 2025-11-26 · CVE-2025-64339

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ClipBucket versions 5.5.2-#146 and below

Description ClipBucket is a video sharing platform. Versions 5.5.2-#146 and below have a stored Cross-site Scripting (XSS) issue in the Manage Playlists feature. Specifically, the Playlist Name field allows an authenticated, low-privileged user to inject malicious HTML/JavaScript code. This code is rendered without proper escaping on playlist detail and listing pages, leading to arbitrary JavaScript execution in the browsers of all viewers, including administrators. The vulnerable field is the Playlist Name field.

Recommendations Update to version 5.5.2-#147.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-64339

GHSA-C695-M4G4-V3FV

Affected Products

Clipbucket

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64339.json · Exploit
• https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc · Patch
• https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-c695-m4g4-v3fv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64339 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64339 · Vendor Advisory
• https://t.me/CVEtracker/36750 · Telegram Post
• https://t.me/cveNotify/142062 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1986718585880809555 · Twitter Post
• https://twitter.com/CVEnew/status/1986694158678171973 · Twitter Post
• https://t.me/cveNotify/144091 · Telegram Post