Medium severity · published Nov 29, 2025
CVE-2025-65113
ClipBucket v5 Unauthenticated Object Flagging Vulnerability
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 - #164, an authorization bypass vulnerability in the AJAX flagging system allows any unauthenticated user to flag any content (users, videos, photos, collections) on the platform. This can lead to mass flagging attacks, content disruption, and moderation system abuse. This issue has been patched in version 5.5.2 - #164.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
clipbucket-v5 · MacWarrior
< 5.5.2 - #164 · source: vendor
CL
Clipbucket · Oxygenz
5.3 before 5.5.2-164 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-65113
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-65113
Patch
https://github.com/MacWarrior/clipbucket-v5/commit/a83b807e592f85d98f1f156bd3cbb1ffcc230233
Exploit
https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-9f8v-vph8-pq6q
More from clipbucket-v5
9.8
CVE-2026-80138
ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter
9.8
CVE-2026-45060
ClipBucket: Blind SQL Injection in progress_video.php
9.8
CVE-2026-42846
ClipBucket: Remote Play URL Command Injection
9.8
CVE-2026-21875
ClipBucket v5 Vulnerable to Blind SQL Injection through Channel Comments
9.8
CVE-2025-21624
ClipBucket V5 Playlist Cover File Upload to Remote Code Execution