Secuno
ENNL
Book demo

CVE-2025-64338

Oxygenz Clipbucket privilege escalation

9.0 CRITICALPublic exploitEPSS 0.49%
  1. Published7 Nov 2025

Description

ClipBucket v5 is an open source video sharing platform. In versions 5.5.2 - #156 and below, an authenticated regular user can create a photo collection whose Collection Name contains HTML/JavaScript payloads, which making ClipBucket’s Manage Photos feature vulnerable to Stored XSS. The payload is rendered unsafely in the Admin → Manage Photos interface, causing it to execute in the administrator’s browser, therefore allowing an attacker to target administrators and perform actions with elevated privileges. This issue is fixed in version 5.5.2 - #157.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionRequired
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Affected products

Oxygenz Clipbucket≥ 5.3 < 5.5.2-157

Remediation

Fixed in
Oxygenz Clipbucket≥ 5.5.2-157

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-928838.7
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before…
CVE-2026-938868.3
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute…
CVE-2026-1096678.8
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation…
CVE-2026-1096338.1
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site…
CVE-2025-714328.1
Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site…
CVE-2024-583908.8
Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management…

Frequently asked

Is CVE-2025-64338 being actively exploited?

CVE-2025-64338 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.49%.

How severe is CVE-2025-64338?

CVE-2025-64338 has a CVSS 3.1 base score of 9.0, rated critical. EPSS estimates a 0.49% probability of exploitation.

Which products are affected by CVE-2025-64338?

Affected products include Oxygenz Clipbucket.

How do I fix CVE-2025-64338?

Upgrade affected software to a fixed version, for example Oxygenz Clipbucket 5.5.2-157 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-64338 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.