CVE-2015-4673

Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via (1) the collection_description parameter to upload/manage_collections.php in an add_new action or the (2) photo_description, (3) photo_tags, or (4) photo_title parameter to upload/actions/photo_uploader.php.

• CWE-79

• http://secpod.org/advisories/SecPod_ClipBucket_Multiple_XSS_Vuln.txtBroken Link
• http://secpod.org/advisories_cvrf/SecPod_ClipBucket_Multiple_XSS_Vuln.xmlBroken Link, Third Party Advisory
• http://www.secpod.com/blog/clipbucket-2-7-0-5-multiple-stored-cross-site-scripting-vulnerability/Broken Link, Third Party Advisory
• http://secpod.org/advisories/SecPod_ClipBucket_Multiple_XSS_Vuln.txtBroken Link
• http://secpod.org/advisories_cvrf/SecPod_ClipBucket_Multiple_XSS_Vuln.xmlBroken Link, Third Party Advisory
• http://www.secpod.com/blog/clipbucket-2-7-0-5-multiple-stored-cross-site-scripting-vulnerability/Broken Link, Third Party Advisory

Published

Apr 6, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-4666Directory traversal vulnerability in opm/read_sessionlog.php…
• CVE-2015-4667Multiple hardcoded credentials in Xsuite 2.x.
• CVE-2015-4668Open redirect vulnerability in Xsuite 2.4.4.5 and earlier al…
• CVE-2015-4669The MySQL "root" user in Xsuite 2.x does not have a password…
• CVE-2015-4670Directory traversal vulnerability in the AjaxFileUpload cont…
• CVE-2015-4671Cross-site scripting (XSS) vulnerability in OpenCart before …
• CVE-2015-4674The autoupdate implementation in TimeDoctor Pro 1.4.72.3 on …
• CVE-2015-4675Buffer overflow in the Tiny SRP library (aka TinySRP) allows…
• CVE-2015-4676SQL injection vulnerability in ticket.php in TickFa 1.x allo…
• CVE-2015-4677Cross-site request forgery (CSRF) vulnerability in FiverrScr…
• CVE-2015-4678SQL injection vulnerability in Persian Car CMS 1.0 allows re…
• CVE-2015-4679Multiple cross-site scripting (XSS) vulnerabilities in the w…