{"cve":"CVE-2025-64114","nvd":{"published":"2025-11-06T00:15:37.980","modified":"2026-10-07T21:10:00.200","status":"Analyzed","description":"ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - #151 and below allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database through its ClipBucket Custom Fields plugin. The vulnerabilities require the Custom Fields plugin to be installed and accessible, and can only be exploited by users with administrative access to the plugin interface. This issue is fixed in version 5.5.2 - #.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","score":6.5},"cwes":["CWE-89"],"references":["https://github.com/MacWarrior/clipbucket-v5/commit/b7289923177fe533ae908654ee3cd65b63ffb008","https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.2-%23152","https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-4g7x-j562-8g69"],"products":["oxygenz:clipbucket"],"source":"nvd","synced_at":"2026-10-19T22:14:53.307938015+00:00"},"epss":{"cve":"CVE-2025-64114","score":0.00422,"percentile":0.36209,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}