CVE-2025-62429 - CVE House

Back to Database

Status published High CVE-2025-62429

ClipBucket v5 executes arbitrary PHP code

7.2 CVSS

Vulnerability Description

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 #147, ClipBucket v5 is vulnerable to arbitrary PHP code execution. In /upload/admin_area/actions/update_launch.php, the "type" parameter from a POST request is embedded into PHP tags and executed. Proper sanitization is not performed, and by injecting malicious code an attacker can execute arbitrary PHP code. This allows an attacker to achieve RCE. This issue has been resolved in version 5.5.2 #147.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62429

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from MacWarrior

View All →

ClipBucket v5 Unauthenticated Object Flagging Vulnerability

ClipBucket v5: Stored XSS Vulnerability in Manage Playlists

ClipBucket's Manage Photos Feature is Vulnerable to Stored XSS via Collection Name

ClipBucket v5's Manage Photo Feature is Vulnerable to Stored XSS Attack via Photo Title

ClipBucket v5: SQL Injection possible through ClipBucket Custom Fields plugin

Affected Vendor

MacWarrior

View all reports →

Affected Software

clipbucket-v5

Vulnerable Versions:

< 5.5.2 #147

Timeline

Official Publish: October 20th, 2025

Last Modified: October 20th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1565.002 Stored Data Manipulation