SQL Injection in Macwarrior Clipbucket-V5

CVE-2026-21875

ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#187 and below allow an attacker to perform Blind SQL Injection through the add comment section within a channel. When adding a comment within a channel, there is a POST request to the /actions/ajax.php endpoint. The obj_id parameter within the POST request to /actions/ajax.php is then used within the user_exists function of the upload/includes/classes/user.class. php file as the $id parameter. It is then used within the count function of the upload/includes/classes/db.class. php file. The $id parameter is concatenated into the query without validation or sanitization, and a user-supplied input like 1' or 1=1-- - can be used to trigger the injection. This issue does not have a fix at the time of publication.

Vulnerability class: SQL Injection

Published · last modified .

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.017 (77.5th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 78th percentile — 77.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-21875: held from 0.018 to 0.017.

EPSS over last 30 days · oldest: 0.018 · newest: 0.017 · change: -0.000

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-21875?
CVE-2026-21875 is a critical-severity vulnerability in Macwarrior Clipbucket-V5, classified under SQL Injection. CVSS score: 9.8/10. Published 2026-01-08.
How severe is CVE-2026-21875?
Critical severity. CVSS v3 base score is 9.8 out of 10.