---
title: "CVE-2026-103766: ClipBucket - SQL Injection"
description: "ClipBucket v5 through 5.5.3-#197 contains an SQL injection caused by improper sanitization of the delete parameter in admin_area/ads_manager.php, letting authenticated users with ad_manager_access inject SQL to extract or modify data."
url: https://panop.io/threat-heartbeat/CVE-2026-103766/
---

# CVE-2026-103766 ClipBucket - SQL Injection

ClipBucket v5 through 5.5.3-#197 contains an SQL injection caused by improper sanitization of the delete parameter in admin\_area/ads\_manager.php, letting authenticated users with ad\_manager\_access inject SQL to extract or modify data.

CVSS base score 7.2 /10

High

CISA KEV

Not listed

Public exploit

None known

Authentication

Required

EPSS

0.36% chance of exploitation in 30 days

[View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-103766)

## Details

Type

SQL Injection

Impact

Information Disclosure, Data Tampering

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Published

2 October 2026

Updated

15 October 2026

Weakness

[CWE-89](https://cwe.mitre.org/data/definitions/89.html)

## Vendor fix

Update to the latest version beyond 5.5.3-#197.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

## References

- [https://nvd.nist.gov/vuln/detail/CVE-2026-103766](https://nvd.nist.gov/vuln/detail/CVE-2026-103766)
- [https://github.com/MacWarrior/clipbucket-v5](https://github.com/MacWarrior/clipbucket-v5)
- [https://github.com/MacWarrior/clipbucket-v5/blob/f15cef1a2431786c31ffd79e81f55d6eeca4ebc0/upload/includes/classes/ads.class.php#L102-L110](https://github.com/MacWarrior/clipbucket-v5/blob/f15cef1a2431786c31ffd79e81f55d6eeca4ebc0/upload/includes/classes/ads.class.php#L102-L110)
- [https://github.com/MacWarrior/clipbucket-v5/pull/925](https://github.com/MacWarrior/clipbucket-v5/pull/925)
- [https://hackmd.io/@leediay/sqli-via-delete-ads-clipbucketv5](https://hackmd.io/@leediay/sqli-via-delete-ads-clipbucketv5)
- [https://www.vulncheck.com/advisories/clipbucket-v5-through-5.5.3-197-sql-injection-via-ads-manager-php-delete-parameter](https://www.vulncheck.com/advisories/clipbucket-v5-through-5.5.3-197-sql-injection-via-ads-manager-php-delete-parameter)

[← All CVEs](https://panop.io/threat-heartbeat/)

## What this record can't tell you

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

Panop answers these inside your environment, for this CVE and every other finding.

[Book a demo](https://panop.io/demo)