---
id: CVE-2026-77928
title: >-
  ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability
  that allows authenticated users to extract arbitrary database contents by
  submitting the msg_id parameter as an array to bypass the clean_requests()
  sanitizatio…
summary: >-
  ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability
  that allows authenticated users to extract arbitrary database contents by
  submitting the msg_id parameter as an array to bypass the clean_requests()
  sanitizatio…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-89
vendor: MacWarrior
product: clipbucket-v5
affected:
  - clipbucket-v5 < 5.5.3-#182
published: '2026-09-18'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:53:07.383'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77928'
references:
  - url: >-
      https://github.com/MacWarrior/clipbucket-v5/commit/85907c5fd1205ccae98c214bed4b3421c632f90c
    label: disclosure@vulncheck.com
  - url: 'https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.3-%23182'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/clipbucket-blind-sql-injection-via-private-message-deletion-endpoint
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00255
epssPercentile: 0.17459
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T14:29:57.538785Z'
ingestedAt: '2026-09-18T14:43:13.067Z'
---

## Overview

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitting the msg_id parameter as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php. Attackers can pass unsanitized array elements through the deletion handler in private_message.php into cb_pm::delete_msg(), which interpolates the unescaped message ID directly into a SQL query string, enabling time-based blind SQL injection to retrieve all user credential hashes and email addresses.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.