How severe is CVE-2025-67418?

CVE-2025-67418 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-67418 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (35th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-67418?

CVE-2025-67418 affects Oxygenz Clipbucket. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-67418?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-67418 have an EU (EUVD) identifier?

Yes. CVE-2025-67418 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-204747.

When was CVE-2025-67418 published?

CVE-2025-67418 was published on 2025-12-22 and last updated on 2026-07-05.

CVE-2025-67418

CVE-2025-67418 is a critical-severity vulnerability in Oxygenz Clipbucket with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-798.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 0% (35th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-204747
Weakness: CWE-798
Affected product: Oxygenz Clipbucket
Published: 2025-12-22
Last modified: 2026-07-05

Description

ClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded default administrative credentials. An unauthenticated remote attacker can log in to the administrative panel using these default credentials, resulting in full administrative control of the application.

Frequently asked questions

What is CVE-2025-67418?: ClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded default administrative credentials. An unauthenticated remote attacker can log in to the administrative panel using these default credentials, resulting in full administrative control of the application.
How severe is CVE-2025-67418?: CVE-2025-67418 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-67418 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (35th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-67418?: CVE-2025-67418 affects Oxygenz Clipbucket. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-67418?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-67418 have an EU (EUVD) identifier?: Yes. CVE-2025-67418 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-204747.
When was CVE-2025-67418 published?: CVE-2025-67418 was published on 2025-12-22 and last updated on 2026-07-05.

References

https://medium.com/@arpit03sharma2003/cve-2025-67418-when-default-credentials-become-a-remote-root-button-03be5ee4b927

EU advisories (EUVD)

http://clipbucket.com

Affected products (1)

cpe:2.3:a:oxygenz:clipbucket:*:*:*:*:*:*:*:*

More vulnerabilities in Oxygenz Clipbucket

CVE-2026-21875 — Critical (CVSS 9.8): ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#187 and below allow an attacker to perform…
CVE-2025-21624 — Critical (CVSS 9.8): ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 239, a file upload vulnerability exists in…
CVE-2024-54136 — Critical (CVSS 9.8): ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is…
CVE-2024-54135 — Critical (CVSS 9.8): ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 2.0 to Version 5.5.1 Revision 199 are…
CVE-2025-64338 — Critical (CVSS 9.0): ClipBucket v5 is an open source video sharing platform. In versions 5.5.2 - #156 and below, an authenticated regular…
CVE-2026-32321 — High (CVSS 8.8): ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability…

All CVEs affecting Oxygenz Clipbucket →

Other CWE-798 (Use of Hard-coded Credentials) vulnerabilities

CVE-2026-13768 — Critical (CVSS 10.0): Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub…
CVE-2026-45631 — Critical (CVSS 10.0): Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.27.0 to before 0.29.3, a hardcoded…
CVE-2026-22769 — Critical (CVSS 10.0): Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability.…
CVE-2025-42890 — Critical (CVSS 10.0): SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended…
CVE-2025-7503 — Critical (CVSS 10.0): An OEM IP camera manufactured by Shenzhen Liandian Communication Technology LTD exposes a Telnet service (port 23) with…
CVE-2025-20309 — Critical (CVSS 10.0): A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session…

Browse all CWE-798 (Use of Hard-coded Credentials) vulnerabilities →