CVE-2025-65858
Published Dec 2, 2025A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payloa…
Vendor/product archive
janeczku / calibre-web CVEs
Beta · best-effort24 CVEs tagged to janeczku / calibre-web — 10 Critical, 2 High, 11 Medium, 1 Low, 0 Unrated.
CVE-2025-7404
Published Jul 24, 2025Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue a…
CVE-2021-3988
Published Nov 15, 2024A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occurs when editing book properties, such as…
CVE-2021-3987
Published Nov 15, 2024An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerabi…
CVE-2021-3986
Published Nov 15, 2024A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221…
CVE-2024-39123
Published Jul 19, 2024In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the clean_string fun…
CVE-2023-2106
Published Apr 15, 2023Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20.
CVE-2022-2525
Published Apr 15, 2023Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20.
CVE-2022-30765
Published May 16, 2022Calibre-Web before 0.6.18 allows user table SQL Injection.
CVE-2022-0990
Published Apr 4, 2022Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.
CVE-2022-0939
Published Apr 4, 2022Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.
CVE-2022-0406
Published Apr 3, 2022Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.
CVE-2022-0405
Published Apr 3, 2022Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.
CVE-2022-0767
Published Mar 7, 2022Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.
CVE-2022-0766
Published Mar 7, 2022Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.
CVE-2022-0339
Published Jan 30, 2022Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.
CVE-2022-0273
Published Jan 30, 2022Improper Access Control in Pypi calibreweb prior to 0.6.16.
CVE-2022-0352
Published Jan 28, 2022Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.
CVE-2021-4164
Published Jan 17, 2022calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-4171
Published Jan 17, 2022calibre-web is vulnerable to Business Logic Errors
CVE-2021-4170
Published Jan 16, 2022calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-25965
Published Nov 16, 2021In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF). By luring an authenticated user to click on a link, an attacker can create a new user…
CVE-2021-25964
Published Oct 4, 2021In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”. An attacker that has access to edit the metadata information, can inject JavaScript pa…
CVE-2020-12627
Published May 4, 2020Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN]LWX/,?RT' hardcoded secret key.
Showing 1-24 of 24 CVEsPage 1 of 1