# cve.now: Macwarrior

The newest entries naming Macwarrior as an affected vendor (up to 200), of 41 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-110627](https://cve.now/CVE-2026-110627.md): ClipBucket v5 through 5.5.3-#206 Reflected XSS via add\_todo val Parameter (CVSS 2.1)
- [CVE-2026-110626](https://cve.now/CVE-2026-110626.md): ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit\_language in language\_settings.php (CVSS 5.1)
- [CVE-2026-110625](https://cve.now/CVE-2026-110625.md): ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged\_item.php (CVSS 5.1)
- [CVE-2026-103766](https://cve.now/CVE-2026-103766.md): ClipBucket v5 through 5.5.3-#197 SQL Injection via ads\_manager.php delete Parameter (CVSS 8.6)
- [CVE-2026-102570](https://cve.now/CVE-2026-102570.md): ClipBucket v5 through 5.5.3-#197 SQL Injection via language\_id Parameter (CVSS 7.0)
- [CVE-2026-102569](https://cve.now/CVE-2026-102569.md): ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter (CVSS 7.0)
- [CVE-2026-100372](https://cve.now/CVE-2026-100372.md): ClipBucket v5 before 5.5.3-#197 Path Traversal via template\_editor.php (CVSS 8.6)
- [CVE-2026-96272](https://cve.now/CVE-2026-96272.md): ClipBucket v5 before 5.5.3-#182 SQL Injection via search\_result.php (CVSS 8.7)
- [CVE-2026-95812](https://cve.now/CVE-2026-95812.md): ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters (CVSS 5.3)
- [CVE-2026-77929](https://cve.now/CVE-2026-77929.md): ClipBucket \< 5.5.3-#182 Remote Code Execution via Photo Upload Endpoint (CVSS 8.7)
- [CVE-2026-77928](https://cve.now/CVE-2026-77928.md): ClipBucket \< 5.5.3-#182 Blind SQL Injection via Private Message Deletion Endpoint (CVSS 7.1)
- [CVE-2026-77927](https://cve.now/CVE-2026-77927.md): ClipBucket \< 5.5.3-#182 Blind SQL Injection via Photo Deletion Endpoint (CVSS 7.1)
- [CVE-2026-80138](https://cve.now/CVE-2026-80138.md): ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php\_cli\_filepath Parameter (CVSS 9.2)
- [CVE-2026-49482](https://cve.now/CVE-2026-49482.md): ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint Allows Mass Subtitle Overwrite (CVSS 4.3)
- [CVE-2026-47238](https://cve.now/CVE-2026-47238.md): ClipBucket: IDOR in videos subtitle editor (CVSS 6.5)
- [CVE-2026-45060](https://cve.now/CVE-2026-45060.md): ClipBucket: Blind SQL Injection in progress\_video.php (CVSS 9.8)
- [CVE-2026-42846](https://cve.now/CVE-2026-42846.md): ClipBucket: Remote Play URL Command Injection (CVSS 9.8)
- [CVE-2026-45418](https://cve.now/CVE-2026-45418.md): ClipBucket: Blind SQL Injection in subtitle\_edit.php (CVSS 8.8)
- [CVE-2026-42847](https://cve.now/CVE-2026-42847.md): ClipBucket: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CVSS 7.1)
- [CVE-2026-32321](https://cve.now/CVE-2026-32321.md): ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration (CVSS 8.8)
- [CVE-2026-28354](https://cve.now/CVE-2026-28354.md): ClipBucket v5 has IDOR in Collection Item Management (CVSS 5.7)
- [CVE-2026-26997](https://cve.now/CVE-2026-26997.md): ClipBucket v5 has Stored XSS via Collection name (CVSS 2.0)
- [CVE-2026-26005](https://cve.now/CVE-2026-26005.md): ClipBucket v5 enables internal network scans via an SSRF vulnerability (CVSS 5.0)
- [CVE-2026-25728](https://cve.now/CVE-2026-25728.md): ClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race Condition (CVSS 9.3)
- [CVE-2026-21875](https://cve.now/CVE-2026-21875.md): ClipBucket v5 Vulnerable to Blind SQL Injection through Channel Comments (CVSS 9.8)
- [CVE-2025-64338](https://cve.now/CVE-2025-64338.md): ClipBucket's Manage Photos Feature is Vulnerable to Stored XSS via Collection Name (CVSS 5.1)
- [CVE-2025-65113](https://cve.now/CVE-2025-65113.md): ClipBucket v5 Unauthenticated Object Flagging Vulnerability (CVSS 6.5)
- [CVE-2025-62709](https://cve.now/CVE-2025-62709.md): ClipBucket v5 is vulnerable to password reset link manipulation (CVSS 6.8)
- [CVE-2025-64339](https://cve.now/CVE-2025-64339.md): ClipBucket v5: Stored XSS Vulnerability in Manage Playlists (CVSS 7.2)
- [CVE-2025-64336](https://cve.now/CVE-2025-64336.md): ClipBucket v5's Manage Photo Feature is Vulnerable to Stored XSS Attack via Photo Title (CVSS 7.2)
- [CVE-2025-64114](https://cve.now/CVE-2025-64114.md): ClipBucket v5: SQL Injection possible through ClipBucket Custom Fields plugin (CVSS 6.5)
- [CVE-2025-62715](https://cve.now/CVE-2025-62715.md): ClipBucket v5: Stored XSS via Collection Tags (CVSS 5.3)
- [CVE-2025-62429](https://cve.now/CVE-2025-62429.md): ClipBucket v5 executes arbitrary PHP code (CVSS 7.2)
- [CVE-2025-62430](https://cve.now/CVE-2025-62430.md): ClipBucket v5 stored XSS via video/photo fields (CVSS 5.4)
- [CVE-2025-62424](https://cve.now/CVE-2025-62424.md): ClipBucket path traversal vulnerability in template editor allows arbitrary file read and write (CVSS 6.7)
- [CVE-2025-62423](https://cve.now/CVE-2025-62423.md): ClipBucket V5 Blind SQL injection in the Admin Panel (CVSS 6.7)
- [CVE-2025-21624](https://cve.now/CVE-2025-21624.md): ClipBucket V5 Playlist Cover File Upload to Remote Code Execution (CVSS 9.8)
- [CVE-2025-21623](https://cve.now/CVE-2025-21623.md): ClipBucket V5 Unauthenticated Template Directory Update to Denial-of-Service (CVSS 7.5)
- [CVE-2025-21622](https://cve.now/CVE-2025-21622.md): ClipBucket V5 Avatar URL Path Traversal to Arbitrary File Delete (CVSS 7.5)
- [CVE-2024-54135](https://cve.now/CVE-2024-54135.md): Untrusted Deserialization in ClipBucket-v5 Version 2.0 to 5.5.1 Revision 199 (CVSS 9.8)
- [CVE-2024-54136](https://cve.now/CVE-2024-54136.md): Untrusted Deserialization in ClipBucket-v5 Version 5.5.1 Revision 199 and Below (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/macwarrior
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.