CVE-2026-32321

HighPublic PoC

Published: 18 March 2026

Published

18 March 2026

Modified

19 March 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0001 2.5th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-32321 is a high-severity SQL Injection (CWE-89) vulnerability in Oxygenz Clipbucket. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 2.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the insufficient input sanitization of the 'userid' parameter by enforcing validation to block SQL injection payloads.

SI-2 Flaw Remediation good match

prevent

Requires timely flaw remediation, such as patching to ClipBucket v5.5.3 #80, to eliminate the SQL injection vulnerability.

SI-9 Information Input Restrictions good match

prevent

Enforces input restrictions at boundaries to limit the 'userid' parameter to valid formats, preventing arbitrary SQL query execution.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

Authenticated blind SQLi in public web endpoint (ajax.php) directly enables T1190 exploitation of public-facing application; arbitrary queries allow credential manipulation and priv esc (T1068) plus full DB disclosure (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 #80 within the `actions/ajax.php` endpoint. Due to insufficient input sanitization of the `userid` parameter, an authenticated attacker can…

execute arbitrary SQL queries, leading to full database disclosure and potential administrative account takeover. Version 5.5.3 #80 fixes the issue.

Deeper analysisAI

ClipBucket v5, an open source video sharing platform, is affected by CVE-2026-32321, an authenticated time-based blind SQL injection vulnerability in versions prior to 5.5.3 #80. The flaw resides in the `actions/ajax.php` endpoint, where insufficient input sanitization of the `userid` parameter allows arbitrary SQL query execution. This CWE-89 issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.

An authenticated attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation enables extraction of sensitive data through blind SQL injection techniques, culminating in full database disclosure and potential takeover of administrative accounts by manipulating user credentials or escalating privileges.

The GitHub security advisory (GHSA-2757-6cp4-v7xx) and fixing commit (726d68b0c9d4c702dce2691c2759b6bf84a1691f) confirm that upgrading to ClipBucket v5.5.3 #80 resolves the issue through proper input sanitization in the affected endpoint. Security practitioners should prioritize patching affected instances and reviewing access controls for authenticated users interacting with the `ajax.php` endpoint.