CVE-2026-110627 Details
Description
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows attackers to inject HTML via the val parameter in mode=add_todo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection, executing script in the admin panel origin.
A reflected cross-site scripting vulnerability has been identified in ClipBucket versions 5.0 through 5.5.3-#206. The issue resides in the admin_area/index.php file, specifically within the 'Add Todo List' functionality. This vulnerability allows attackers to inject HTML, including JavaScript, via the 'val' parameter. Exploitation involves luring a logged-in administrator into submitting a crafted POST request, which is executed in the context of the admin panel.
The vulnerability has been patched in ClipBucket version 5.5.3-#206. Users should update to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@leediay/BJR_lh2ifg | CISA-ADP | BundleExploitRemedyTechnical Description |
| https://github.com/MacWarrior/clipbucket-v5 | [email protected] | ProductSource CodeVendor |
| https://github.com/MacWarrior/clipbucket-v5/blob/01990c0fa7baf925d2a4cf6ec1b75b1341b7a486/upload/admin_area/index.php#L16-L25 | [email protected] | Source CodeVendor |
| https://github.com/MacWarrior/clipbucket-v5/commit/b251858e06ba2895a845497fb2e84fcd083f6f63 | [email protected] | Source CodeVendor |
| https://hackmd.io/@leediay/BJR_lh2ifg | [email protected] | BundleExploitRemedyTechnical Description |
| https://www.vulncheck.com/advisories/clipbucket-v5-through-5.5.3-206-reflected-xss-via-add-todo-val-parameter | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ClipBucket | <= 5.5.3-#206 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |