CVE-2025-67418

critical · 9.8

ClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded default administrative credentials. An unauthenticated remote attacker can log in to the administrative panel using these default credentials, resulting in full administrative control of the application.

9.8

CVSS

0.5%

EPSS (exploit prob.)

43rd

EPSS percentile

2025-12-22

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-798

Affected products

Vendor	Product	Affected versions
oxygenz	clipbucket	>= 5.3, <= 5.5.2

Check a specific version with /api/v1/cve/match.

References

https://medium.com/@arpit03sharma2003/cve-2025-67418-when-default-credentials-become-a-remote-root-button-03be5ee4b927

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-67418