What’s Vulnerable › Vulnerabilities

CVE-2025-62715: ClipBucket v5: Stored XSS via Collection Tags

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-11-04 · updated 2026-10-18
• Weakness: CWE-79

Description

ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#147 and below contain a stored Cross-Site Scripting (XSS) vulnerability in ClipBucket’s Collection tags feature. An authenticated normal user can create a tag containing HTML or JavaScript, which is later rendered unescaped in collection detail and tag-list pages. As a result, arbitrary JavaScript executes in the browsers of all users who view the affected pages. This issue is fixed in version 5.5.2-#152.

Affected products

• MacWarrior clipbucket-v5: from 5.3 before 5.5.2-157 — fixed in 5.5.2-157

How to fix

Upgrade to a fixed version: MacWarrior clipbucket-v5 5.5.2-157. Check the vendor advisory for mitigations.

References

• https://github.com/MacWarrior/clipbucket-v5/commit/8e3cf79ce2721fbebde68a05a9a1a6319f086bcc
• https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-h5f4-wj75-39x3

Get alerted when CVE-2025-62715 or the next vulnerability affects your stack