CVE-2025-64338

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-64338
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-64338.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-64338
Aliases
  • GHSA-93rh-fxxx-j38j
Published
2025-11-07T05:16:10.167Z
Modified
2026-04-02T12:59:18.516954Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
ClipBucket's Manage Photos Feature is Vulnerable to Stored XSS via Collection Name
Details

ClipBucket v5 is an open source video sharing platform. In versions 5.5.2 - #156 and below, an authenticated regular user can create a photo collection whose Collection Name contains HTML/JavaScript payloads, which making ClipBucket’s Manage Photos feature vulnerable to Stored XSS. The payload is rendered unsafely in the Admin → Manage Photos interface, causing it to execute in the administrator’s browser, therefore allowing an attacker to target administrators and perform actions with elevated privileges. This issue is fixed in version 5.5.2 - #157.

Database specific 
{
    "cwe_ids": [
        "CWE-269",
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64338.json"
}
References

Affected packages

Git / github.com/macwarrior/clipbucket-v5

Affected ranges

Type
GIT
Repo
https://github.com/macwarrior/clipbucket-v5
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8e3cf79ce2721fbebde68a05a9a1a6319f086bcc

Affected versions

5.*
5.3
5.3.1
5.4.0
5.4.1
5.5.0
5.5.1
5.5.2-#103
5.5.2-#106
5.5.2-#114
5.5.2-#117
5.5.2-#120
5.5.2-#123
5.5.2-#129
5.5.2-#133
5.5.2-#135
5.5.2-#138
5.5.2-#140
5.5.2-#25
5.5.2-#38
5.5.2-#4
5.5.2-#45
5.5.2-#58
5.5.2-#69
5.5.2-#74
5.5.2-#82
5.5.2-#86
5.5.2-#90
5.5.2-#98

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "5.3"
            },
            {
                "fixed": "5.5.2-157"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-64338.json"