CVE-2026-49482

{
  "id": "CVE-2026-49482",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-12T00:16:19.363",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard characters in the subtitle editing endpoint. An authenticated user can send a % character as the number parameter to overwrite all subtitle titles of any video they own in a single HTTP request. This issue has been patched in version 5.5.3 - #141."
    },
    {
      "lang": "es",
      "value": "ClipBucket v5 es una plataforma de código abierto para compartir videos. Antes de la versión 5.5.3 - #141, ClipBucket v5 contiene una neutralización incorrecta de caracteres comodín SQL en el endpoint de edición de subtítulos. Un usuario autenticado puede enviar un carácter ’%’ como parámetro ’number’ para sobrescribir todos los títulos de los subtítulos de cualquier video de su propiedad en una única solicitud HTTP. Este problema ha sido parcheado en la versión 5.5.3 - #141."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "MacWarrior",
          "product": "clipbucket-v5",
          "versions": [
            {
              "version": "< 5.5.3 - #141",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-12T13:36:53.029345Z",
          "id": "CVE-2026-49482",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-155"
        },
        {
          "lang": "en",
          "value": "CWE-943"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-wv43-277p-737c",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-wv43-277p-737c",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}