$ cve CVE-2012-5849 JSON

CVE-2012-5849 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 2.8% (pctl 86)

Patch early

A public exploit exists.

Description

Multiple SQL injection vulnerabilities in ClipBucket 2.6 Revision 738 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) uid parameter in an add_friend action to ajax.php; id parameter in a (2) share_object, (3) add_to_fav, (4) rating, or (5) flag_object action to ajax.php; cid parameter in an (6) add_new_item, (7) remove_collection_item, (8) get_item, or (9) load_more_items action to ajax.php; (10) ci_id parameter in a get_item action to ajax.php; user parameter to (11) user_contacts.php or (12) view_channel.php; (13) pid parameter to view_page.php; (14) tid parameter to view_topic.php; or (15) v parameter to watch_video.php.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	2.84% — more likely to be exploited than 86% of all CVEs
Weakness	CWE-89
On CISA KEV	no
Public exploit	yes
Published	2015-05-14
Last modified	2026-06-16

Affected (1)

Vendor	Product
clip-bucket	clipbucket

Public exploits

Source	Title	Date
exploit-db	Clipbucket 2.6 Revision 738 - Multiple SQL Injections	2012-12-09

References

→ the Explorer · watch your stack · NVD