CVE-2026-102570
Medium
Description
ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basic_settings permission can inject arbitrary SQL payloads to extract or modify database contents.
SeverityMedium
CVSS5.5
Exploit probability—
ProductMacwarrior Clipbucket-v5
PublishedSep 29, 2026
First seenSep 29, 2026
Weakness typeCWE-89SQL injection
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| MacWarrior clipbucket-v5 | v ≤ 5.5.3-#197 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.