CVE-2026-110626
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter.
Published Oct 14, 2026 · updated Oct 14, 2026
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter. Attackers can send administrators with basic_settings permission a crafted link whose payload is echoed into a hidden input, executing script in the admin panel origin.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter. Attackers can send administrators with basic_settings permission a crafted link whose payload is echoed into a hidden input, executing script in the admin panel origin.
Oct 14, 2026 · NIST NVD
Updated
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter. Attackers can send administrators with basic_settings permission a crafted link whose payload is echoed into a hidden input, executing script in the admin panel origin.
Sources
- CVE.orgCVE-2026-110626
Official CVE identifier
cve.org - NIST NVDCVE-2026-110626
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter. Attackers can send administrators with basic_settings permission a crafted link whose payload is echoed into
nvd.nist.gov