# CVE-2026-77928: ClipBucket SQL injection in private message deletion

Source: https://junglewise.ai/threats/cve-2026-77928-clipbucket-sql-injection-in-private-message-deletion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-77928 · Severity: medium · CVSS 6.5 · Published 2026-09-18

ClipBucket is a video sharing platform application. A flaw in the private message deletion feature allows authenticated users to inject malicious SQL commands by bypassing input validation, enabling them to extract sensitive data including all user passwords and email addresses from the database.

## Quick answers

**Is CVE-2026-77928 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77928 being exploited in the wild.

**How severe is CVE-2026-77928?** Medium severity, with a CVSS score of 6.5, published 18 September 2026.

**Which products and versions are affected?** ClipBucket ClipBucket v5 before 5.5.3-#182.

**Is there a fix for CVE-2026-77928?** A patch was published on 2026-08-28: Version 5.5.3-#182 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77928 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-77928?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a blind SQL injection in the private message deletion handler (private_message.php) affecting ClipBucket v5 before version 5.5.3-#182. The root cause is that the clean_requests() sanitization function in ClipBucket.class.php can be bypassed by passing the msg_id parameter as an array, which then flows unsanitized into cb_pm::delete_msg(). The vulnerable code directly interpolates the unescaped message ID into a SQL query string without proper parameterization. The attack requires authentication and allows time-based blind SQL injection to extract arbitrary database contents. The vulnerability was patched in version 5.5.3-#182 released on 28 August 2026.

## Affected products

- ClipBucket ClipBucket v5 before 5.5.3-#182

## Timeline

- 2026-09-18: disclosed
- 2026-08-28: patched: Version 5.5.3-#182 released

## References

- [https://github.com/MacWarrior/clipbucket-v5/commit/85907c5fd1205ccae98c214bed4b3421c632f90c](https://github.com/MacWarrior/clipbucket-v5/commit/85907c5fd1205ccae98c214bed4b3421c632f90c)
- [https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.3-%23182](https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.3-%23182)