{"id":"CVE-2026-21875","summary":"ClipBucket v5 Vulnerable to Blind SQL Injection through Channel Comments","details":"ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#187 and below allow an attacker to perform Blind SQL Injection through the add comment section within a channel. When adding a comment within a channel, there is a POST request to the /actions/ajax.php endpoint. The obj_id parameter within the POST request to /actions/ajax.php is then used within the user_exists function of the upload/includes/classes/user.class. php file as the $id parameter. It is then used within the count function of the upload/includes/classes/db.class. php file. The $id parameter is concatenated into the query without validation or sanitization, and a user-supplied input like 1' or 1=1-- - can be used to trigger the injection. This issue does not have a fix at the time of publication.","aliases":["GHSA-crpv-fmc4-j392"],"modified":"2026-08-12T03:51:19.902960636Z","published":"2026-01-07T23:52:18.729Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21875.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21875.json"},{"type":"ADVISORY","url":"https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-crpv-fmc4-j392"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21875"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/macwarrior/clipbucket-v5","events":[{"introduced":"100b79b02d67dfb1abaa89b21434a04f15736875"},{"last_affected":"100b79b02d67dfb1abaa89b21434a04f15736875"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"\u003c= 5.5.2-#187"},{"last_affected":"\u003c= 5.5.2-#187"}]}}],"versions":["\u003c= 5.5.2-#187","5.5.2-#187"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21875.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}