CVE-2025-64339 - CVE House

Back to Database

Status published High CVE-2025-64339

ClipBucket v5: Stored XSS Vulnerability in Manage Playlists

7.2 CVSS

Vulnerability Description

ClipBucket v5 is an open source video sharing platform. In versions 5.5.2-#146 and below, the Manage Playlists feature is vulnerable to stored Cross-site Scripting (XSS),specifically in the Playlist Name field. An authenticated low-privileged user can create a playlist with a malicious name containing HTML/JavaScript code, which is rendered unescaped on playlist detail and listing pages. This results in arbitrary JavaScript execution in every viewer’s browser, including administrators. This issue is fixed in version 5.5.2-#147.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64339

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from MacWarrior

View All →

ClipBucket v5 Unauthenticated Object Flagging Vulnerability

ClipBucket's Manage Photos Feature is Vulnerable to Stored XSS via Collection Name

ClipBucket v5's Manage Photo Feature is Vulnerable to Stored XSS Attack via Photo Title

ClipBucket v5: SQL Injection possible through ClipBucket Custom Fields plugin

ClipBucket v5: Stored XSS via Collection Tags

Affected Vendor

MacWarrior

View all reports →

Affected Software

clipbucket-v5

Vulnerable Versions:

< 5.5.2-#147

Timeline

Official Publish: November 7th, 2025

Last Modified: November 7th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement