CVE-2026-32321

HighPublic PoC

Published: 18 March 2026

Published

18 March 2026

Modified

19 March 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0043 34.4th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-32321 is a high-severity SQL Injection (CWE-89) vulnerability in Oxygenz Clipbucket. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

ClipBucket v5, an open source video sharing platform, is affected by CVE-2026-32321, an authenticated time-based blind SQL injection vulnerability in versions prior to 5.5.3 #80. The flaw resides in the `actions/ajax.php` endpoint, where insufficient input sanitization of the `userid` parameter allows arbitrary SQL query execution. This CWE-89 issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.

An authenticated attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation enables extraction of sensitive data through blind SQL injection techniques, culminating in full database disclosure and potential takeover of administrative accounts by manipulating user credentials or escalating privileges.

The GitHub security advisory (GHSA-2757-6cp4-v7xx) and fixing commit (726d68b0c9d4c702dce2691c2759b6bf84a1691f) confirm that upgrading to ClipBucket v5.5.3 #80 resolves the issue through proper input sanitization in the affected endpoint. Security practitioners should prioritize patching affected instances and reviewing access controls for authenticated users interacting with the `ajax.php` endpoint.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-12960

Vulnerability details

ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 #80 within the `actions/ajax.php` endpoint. Due to insufficient input sanitization of the `userid` parameter, an authenticated attacker can…

execute arbitrary SQL queries, leading to full database disclosure and potential administrative account takeover. Version 5.5.3 #80 fixes the issue.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

Authenticated blind SQLi in public web endpoint (ajax.php) directly enables T1190 exploitation of public-facing application; arbitrary queries allow credential manipulation and priv esc (T1068) plus full DB disclosure (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0