CVE-2025-67418

ClipBucket 5.5.2 is deployed with default, hardcoded credentials for the administration panel (CWE-798 — use of hardcoded credentials). Without any prior authentication, an attacker can use these known, publicly available credentials to gain access to the administrative interface. No user interaction or knowledge of the target environment specifics is required — network access to the application management panel is sufficient.

Attacker gains full administrative control over the application, which may lead to account takeover, data leaks, content modification, and potential further compromise of server infrastructure.

Default administrator credentials must be changed immediately after each installation or application update. It is recommended to apply patches available from the vendor according to references. Until the update is applied, access to the administration panel should be restricted exclusively to trusted IP addresses using a firewall or other access control mechanisms.

ClipBucket version 5.5.2 (Oxygenz company product)