CVE-2026-102569

MediumCVSS 5.5/10Last modified Oct 2, 2026

Description

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with video_moderation permission can inject arbitrary SQL commands to extract or modify database contents.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Sep 29, 2026
Last modified: Oct 2, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-102576.3A security flaw has been discovered in itsourcecode Content Management System 1.0. This issue affects some unknown processing of the file /a CVE-2026-1025705.5ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_CVE-2026-1025764.2A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XS CVE-2026-1025774.3A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authe CVE-2026-1025788.8A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly int CVE-2026-1025794.3A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile informa CVE-2026-102586.3A weakness has been identified in itsourcecode Content Management System 1.0. Impacted is an unknown function of the file /admin/add_sub_top CVE-2026-1025804.3A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component CVE-2026-1025815.4A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS CVE-2026-1025824.3A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, al CVE-2026-1025832.7A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web servic CVE-2026-1025844.3A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade pe