CVE-2026-49482 - ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint Allows Mass Subtitle Overwrite

Back Back to CVE browser

MEDIUM

ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint Allows Mass Subtitle Overwrite

Published Jun 11, 2026

4.3

MEDIUM

CVSS 3.1

EPSS 0.28%

Description

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard characters in the subtitle editing endpoint. An authenticated user can send a % character as the number parameter to overwrite all subtitle titles of any video they own in a single HTTP request. This issue has been patched in version 5.5.3 - #141.

Affected products

Vendor MacWarrior Product Clipbucket-V5 Default
n/a
- Version
  < 5.5.3 - #141
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

MacWarrior

Clipbucket-V5

n/a

Version	Status	Constraints
< 5.5.3 - #141	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-155

CWE-943

References (1)

https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-wv43-277p-737c
exploitx_refsource_CONFIRM

Link	Providers	Tags
https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-wv43-277p-737c		exploitx_refsource_CONFIRM

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitHub_M

Published Jun 11, 2026

Updated Jun 12, 2026

Reserved May 30, 2026

Link CVE-2026-49482

CISA Vulnrichment

Updated Jun 12, 2026

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2026-49482

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-49482