MacWarrior vulnerabilities
We track 21 vulnerabilities in MacWarrior products. 21 are rated high or critical, and none are known to be exploited. The most recent was published on October 2, 2026.
Latest MacWarrior vulnerabilities
- 7.2 High severity
clipbucket-v5: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers can supply time-based blind payloads conc
- 7.2 High severity
clipbucket-v5: Improper Limitation of a Pathname to a Restricted Directory
ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with manage_templ
- 7.5 High severity
clipbucket-v5: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection
- 8.8 High severity
clipbucket-v5: Unrestricted Upload of File with Dangerous Type
ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile() function
- 9.8 Critical severity
clipbucket-v5: Improper Neutralization of Special Elements used in an OS Command
ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to exec
- 8.8 High severity
clipbucket-v5: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authenticated user who can upload videos can add multiple subtitles from different files and change their title (English, Spanish...). The POST /actions/subtitle_edit.ph
- 9.8 Critical severity
clipbucket-v5: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter to execute SQL queries and exfiltrate se
- 9.8 Critical severity
clipbucket-v5: Improper Neutralization of Special Elements used in an OS Command
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a param
- 7.1 High severity
clipbucket-v5: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #122, there is a critical SQL Injection (SQLi) vulnerability in ClipBucket, exploitable through the type parameter on the authenticated admin endpoint admin_area/action_logs.php. The endp
- 8.8 High severity
clipbucket-v5: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 #80 within the `actions/ajax.php` endpoint. Due to insufficient input sanitization of the `userid` paramet
- 7.5 High severity
clipbucket-v5: Time-of-check Time-of-use (TOCTOU) Race Condition
ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #40, a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability exists in ClipBucket's avatar and background image upload functionality. The application moves uploaded files to
- 9.8 Critical severity
clipbucket-v5: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#187 and below allow an attacker to perform Blind SQL Injection through the add comment section within a channel. When adding a comment within a channel, there is a POST request to the /act
- 8.8 High severity
clipbucket-v5: Weak Password Recovery Mechanism for Forgotten Password
ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build the server URL from the incoming HTTP Host header when the configuration base_url is not set. Because
- 9.0 Critical severity
clipbucket-v5: Improper Neutralization of Input During Web Page Generation
ClipBucket v5 is an open source video sharing platform. In versions 5.5.2 - #156 and below, an authenticated regular user can create a photo collection whose Collection Name contains HTML/JavaScript payloads, which making ClipBucket’s Manage Photos feature vul
- 7.2 High severity
clipbucket-v5: Improper Control of Generation of Code
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 #147, ClipBucket v5 is vulnerable to arbitrary PHP code execution. In /upload/admin_area/actions/update_launch.php, the "type" parameter from a POST request is embedded into PHP tag
- 7.2 High severity
clipbucket-v5: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket V5 provides open source video hosting with PHP. In version5.5.2 - #140 and earlier, a Blind SQL injection vulnerability exists in the Admin Area’s “/admin_area/login_as_user.php” file. Exploiting this vulnerability requires access privileges to the
- 9.8 Critical severity
clipbucket-v5: Unrestricted Upload of File with Dangerous Type
ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 239, a file upload vulnerability exists in the Manage Playlist functionality of the application, specifically surrounding the uploading of playlist cover images. Without proper checks,
- 7.5 High severity
clipbucket-v5: Improper Limitation of a Pathname to a Restricted Directory
ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 238, ClipBucket V5 allows unauthenticated attackers to change the template directory via a directory traversal, which results in a denial of service.
- 9.1 Critical severity
clipbucket-v5: Improper Limitation of a Pathname to a Restricted Directory
ClipBucket V5 provides open source video hosting with PHP. During the user avatar upload workflow, a user can choose to upload and change their avatar at any time. During deletion, ClipBucket checks for the avatar_url as a filepath within the avatars subdirect
- 9.8 Critical severity
clipbucket-v5: Deserialization of Untrusted Data
ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/upload.php where the user supplied input via collection get par
- 8.8 High severity
clipbucket-v5: Deserialization of Untrusted Data
ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 2.0 to Version 5.5.1 Revision 199 are vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/photo_upload.php within the decode_key function. User inp