Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-64336

Good to know:

icon
icon

Date: November 6, 2025

ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Photos feature is vulnerable to stored Cross-site Scripting (XSS). An authenticated regular user can upload a photo with a malicious Photo Title containing HTML/JavaScript code. While the payload does not execute in the user-facing photo gallery or detail pages, it is rendered unsafely in the Admin → Manage Photos section, resulting in JavaScript execution in the administrator’s browser. This issue is fixed in version 5.5.2-#147.

Severity Score

Related Resources (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-64336
https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc
https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-hjc2-5329-j49w
https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.2-%23147
https://www.mend.io/vulnerability-database/CVE-2025-64336

Severity Score

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

Improper Privilege Management

CWE-269

Top Fix

icon

Upgrade Version

Upgrade to version https://github.com/MacWarrior/clipbucket-v5.git - 5.5.2-#147

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): LOW

Do you need more information?

Contact Us