CVE-2026-103766 — CVE & Security Advisory Radar

🎯 CVE-2026-103766 🧪 PoC 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-103766 | ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries to extract user credentials and emails or modify and delete arbitrary records.

ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries to extract user credentials and emails or modify and delete arbitrary records.

Klassifikation & Betroffenheit:

MacWarrior clipbucket-v5 0 ≤5.5.3-#197

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 🎯 High

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as…

🛡️ Empfohlene Mitigation: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, consider using persistence layers such as Hibernate or Enterprise Java Beans, which can provide significant protection against SQL injection if used proper…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-7 · Blind SQL Injection (High) CAPEC-66 · SQL Injection (High) CAPEC-108 · Command Line Execution through SQL Injec… (Very High) CAPEC-109 · Object Relational Mapping Injection (High) CAPEC-110 · SQL Injection through SOAP Parameter Tam… (Very High) CAPEC-470 · Expanding Control over the Operating Sys… (Very High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-45060 9.8 CVE-2026-42846 9.8 CVE-2026-21875 9.8 CVE-2025-21624 9.8 CVE-2024-54135 9.8

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 10/2026

Heute 03.10.

CVSS-Vektor-Analyse: 8.6

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Hoch

UI · Interaktion Keine

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CNA-Bewertung (VulnCheck): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA…

Veröffentlicht:02.10.2026

Aktualisiert:02.10.2026 18:47

Assigner (CNA):VulnCheck

EUVD-ID:EUVD-2026-91138

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-89: SQL Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	2026-09-19	2026-10-03
≥90 %	538	364
≥50 %	1603	1115
≥10 %	17	3
<10 %	56400	485

8.6 HIGH

EPSS

0.4%

CVE-2026-103766 🌐 Netzwerk (Remote) 🔐 Admin-Rechte nötig

MacWarrior

CVE-2026-103766 | ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries to extract user credentials and emails or modify and delete arbitrary records.

CWE-89: SQL Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

01.10.2026

🛡️ Details ➔

Noch keine Analyse zu CVE-2026-103766

Beitrag zu CVE-2026-103766 verfassen

Zero-Day & Vulnerability Intelligence Hub