CVE-2012-6644 json
Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.6 allow remote attackers to inject arbitrary web script or HTML via the…
published 2014-04-08 12 y ago modified 2026-06-16 4 mo ago also EUVD-2012-6490
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.2%
- EPSS 3.2% chance of exploitation in 30 days, percentile 88%
- public exploits
- 8
- Exploit-DB
Summary
Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.6 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to channels.php, (2) collections.php, (3) groups.php, or (4) videos.php; (5) query parameter to search_result.php; or (6) type parameter to view_collection.php or (7) view_item.php.
Timeline
- First public exploit (EDB-36530)
- Published
Exploit prediction
3.18% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-36530 Clipbucket 2.6 - 'view_item.php?type' Cross-Site Scripting webapps, 2012-01-09
- EDB-36529 Clipbucket 2.6 - 'view_collection.php?type' Cross-Site Scripting webapps, 2012-01-09
- EDB-36528 Clipbucket 2.6 - 'videos.php?cat' Cross-Site Scripting webapps, 2012-01-09
- EDB-36527 Clipbucket 2.6 - 'search_result.php?query' Cross-Site Scripting webapps, 2012-01-09
- EDB-36526 Clipbucket 2.6 - 'groups.php?cat' Cross-Site Scripting webapps, 2012-01-09
- EDB-36525 Clipbucket 2.6 - 'collections.php?cat' Cross-Site Scripting webapps, 2012-01-09
- EDB-36524 Clipbucket 2.6 - 'channels.php?cat' Cross-Site Scripting webapps, 2012-01-09
- EDB-18341 Clipbucket 2.6 - Multiple Vulnerabilities webapps, 2012-01-09
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
exploit-db.com
/exploits/18341
exploit
-
osvdb.org
/78195
vdb-entry
-
securityfocus.com
/bid/51321
vdb-entry
-
osvdb.org
/78194
vdb-entry
-
osvdb.org
/78199
vdb-entry
- packetstormsecurity.org /files/108489/clipbucket-sqlxss.txt
-
osvdb.org
/78196
vdb-entry
-
osvdb.org
/78197
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/72245
vdb-entry
-
osvdb.org
/78193
vdb-entry
-
osvdb.org
/78198
vdb-entry
-
secunia.com
/advisories/47474
third-party-advisory
-
osvdb.org
/78200
vdb-entry
Sources
- CVE List CVE-2012-6644
- NVD CVE-2012-6644
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.