CVE-2025-64114 ClipBucket v5: SQL Injection possible through ClipBucket Custom Fields plugin

What is CVE-2025-64114?

CVE-2025-64114 is a medium-severity SQL injection vulnerability in MacWarrior clipbucket-v5, published on 5 Nov 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - #151 and below allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database through its ClipBucket Custom Fields plugin. The vulnerabilities require the Custom Fields plugin to be installed and accessible, and can only be exploited by users with administrative access to the plugin interface. This issue is fixed in version 5.5.2 - #.

Weakness: CWE-89

Which versions are affected by CVE-2025-64114?

It affects 1 product.

Products include Oxygenz Clipbucket.

How do I fix CVE-2025-64114?

No fix has been published for CVE-2025-64114 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2025-64114 being exploited?

There is no known exploitation of CVE-2025-64114 in the wild and no public exploit code.

Other vulnerabilities in MacWarrior clipbucket-v5

• CVE-2026-21875 ClipBucket v5 Vulnerable to Blind SQL Injection through Channel Comments Critical 9.8
• CVE-2025-67418 Hardcoded credentials in n/a Critical 9.8
• CVE-2025-21624 ClipBucket V5 Playlist Cover File Upload to Remote Code Execution Critical 9.8
• CVE-2024-54135 Untrusted Deserialization in ClipBucket-v5 Version 2.0 to 5.5.1 Revision 199 Critical 9.8
• CVE-2024-54136 Untrusted Deserialization in ClipBucket-v5 Version 5.5.1 Revision 199 and Below Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4g7x-j562-8g69.