Is CVE-2026-110627 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110627?

CVE-2026-110627 has a CVSS v3 severity of MEDIUM (4.7).

Back

CVE-2026-110627

Description

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows attackers to inject HTML via the val parameter in mode=add_todo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection, executing script in the admin panel origin.