Skip to content
OpenAdvisories

Package · PyPI

calibreweb

18 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Low 3.5
    CVE-2025-65858 Public exploit

    Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation

    A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is …

    calibreweb PyPI
  • Medium 5.9
    CVE-2025-7404 Public exploit

    Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind C

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.

    Calibre Web Autocaliweb Calibre Web Autocaliweb PyPI
  • High 8.7
    CVE-2025-6998 Public exploit

    Calibre Web 0.6.24 & Autocaliweb 0.7.0 - ReDoS

    ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login. This…

    Calibre Web Autocaliweb Calibre Web Autocaliweb PyPI
  • Medium 5.4
    CVE-2024-39123 Public exploit EPSS 23%

    Calibre-Web Cross Site Scripting (XSS)

    In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the clean_string function. The vulnerability arises from the way the clean_string function handles H…

    calibreweb PyPI