CVE-2025-62430
ClipBucket v5 stored XSS via video/photo fields
Description
ClipBucket v5 is an open source video sharing platform. ClipBucket v5 through build 5.5.2 #145 allows stored cross-site scripting (XSS) in multiple video and photo metadata fields. For videos the Tags field and the Genre, Actors, Producer, Executive Producer, and Director fields in Movieinfos accept user supplied values without adequate sanitization. For photos the Photo Title and Photo Tags fields accept user supplied values without adequate sanitization. A regular user who can edit a video or photo can inject script (for example by supplying a value such as a closing delimiter followed by a script element). The injected script executes when any user, including an unauthenticated visitor or an administrator, views the affected video or photo page. Although cookies are set with the HttpOnly attribute and cannot be read directly, the injected script can issue fetch requests to endpoints such as admin_area pages and exfiltrate their contents or trigger unintended actions. Version 5.5.2 build #146 and later contain a fix. Update to build 5.5.2 #146 or later. No known workarounds exist.
INFO
Published Date :
Oct. 17, 2025, 6:15 p.m.
Last Modified :
Oct. 8, 2026, 10:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update ClipBucket to build 5.5.2 #146 or later.
- Apply the vendor-provided security patch.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-62430.
| URL | Resource |
|---|---|
| https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc | Patch |
| https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-qrqq-hpf3-9mc9 | Exploit Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-62430 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-62430
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-62430 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-62430 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 08, 2026
Action Type Old Value New Value Added Translation Title: clipbucket-v5 de MacWarrior, Description: ClipBucket v5 es una plataforma de código abierto para compartir videos. ClipBucket v5 hasta la compilación 5.5.2 #145 permite cross-site scripting (XSS) almacenado en múltiples campos de metadatos de video y foto. Para videos, el campo Etiquetas y los campos Género, Actores, Productor, Productor Ejecutivo y Director en Movieinfos aceptan valores proporcionados por el usuario sin una sanitización adecuada. Para fotos, los campos Título de la Foto y Etiquetas de la Foto aceptan valores proporcionados por el usuario sin una sanitización adecuada. Un usuario regular que puede editar un video o una foto puede inyectar scripts (por ejemplo, proporcionando un valor como un delimitador de cierre seguido de un elemento de script). El script inyectado se ejecuta cuando cualquier usuario, incluyendo un visitante no autenticado o un administrador, ve la página del video o la foto afectada. Aunque las cookies se configuran con el atributo HttpOnly y no se pueden leer directamente, el script inyectado puede emitir solicitudes de obtención a puntos finales como las páginas de admin_area y exfiltrar sus contenidos o desencadenar acciones no deseadas. La versión 5.5.2 compilación #146 y posteriores contienen una corrección. Actualice a la compilación 5.5.2 #146 o posterior. No existen soluciones alternativas conocidas. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'MacWarrior', 'product': 'clipbucket-v5', 'versions': [{'status': 'affected', 'version': '< 5.5.2 - #146'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-62430', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2025-10-17T18:03:24.228892Z'} -
Reanalysis by [email protected]
Nov. 10, 2025
Action Type Old Value New Value Changed CPE Configuration OR *cpe:2.3:a:oxygenz:clipbucket:*:*:*:*:*:*:*:* versions up to (excluding) 5.5.2-146 OR *cpe:2.3:a:oxygenz:clipbucket:*:*:*:*:*:*:*:* versions from (including) 5.3 up to (excluding) 5.5.2-146 -
Initial Analysis by [email protected]
Nov. 07, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Added CPE Configuration OR *cpe:2.3:a:oxygenz:clipbucket:*:*:*:*:*:*:*:* versions up to (excluding) 5.5.2-146 Added Reference Type GitHub, Inc.: https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc Types: Patch Added Reference Type GitHub, Inc.: https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-qrqq-hpf3-9mc9 Types: Exploit, Vendor Advisory -
New CVE Received by [email protected]
Oct. 17, 2025
Action Type Old Value New Value Added Description ClipBucket v5 is an open source video sharing platform. ClipBucket v5 through build 5.5.2 #145 allows stored cross-site scripting (XSS) in multiple video and photo metadata fields. For videos the Tags field and the Genre, Actors, Producer, Executive Producer, and Director fields in Movieinfos accept user supplied values without adequate sanitization. For photos the Photo Title and Photo Tags fields accept user supplied values without adequate sanitization. A regular user who can edit a video or photo can inject script (for example by supplying a value such as a closing delimiter followed by a script element). The injected script executes when any user, including an unauthenticated visitor or an administrator, views the affected video or photo page. Although cookies are set with the HttpOnly attribute and cannot be read directly, the injected script can issue fetch requests to endpoints such as admin_area pages and exfiltrate their contents or trigger unintended actions. Version 5.5.2 build #146 and later contain a fix. Update to build 5.5.2 #146 or later. No known workarounds exist. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Added CWE CWE-79 Added Reference https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc Added Reference https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-qrqq-hpf3-9mc9