janeczku

Records25All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical10CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

janeczku records in CISA KEV

No janeczku vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Calibre-web 24 records HIGH

Records

25 records

TI-2023-01981 CVE-2023-2106 · GHSA-mhmp-m6g7-7c24

Weak Password Requirements in janeczku/calibre-web

HIGH 82

Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00748 Published 2023-04-15 Fixed in 0.6.20 CWE-521

TI-2022-02333 CVE-2022-2525 · GHSA-jg8w-wgx2-g7q4

Improper Restriction of Excessive Authentication Attempts in janeczku/calibre-web

HIGH 82

Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00769 Published 2023-04-15 Fixed in 0.6.20 CWE-307

TI-2021-07971 CVE-2021-25965 · GHSA-v5hx-2wwf-52wx

Calibre-web - Admin Account Takeover via Cross-Site Request Forgery (CSRF)

HIGH 73

In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00527 Published 2021-11-16 No fix listed CWE-352

TI-2025-06745 CVE-2025-7404 · GHSA-qc4j-v7h6-xr5h

Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind C

MEDIUM 60

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 (Nicolette); A…

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.02759 Published 2025-07-24 Fixed in 0.7.1 CWE-78

TI-2021-02885 CVE-2021-3988 · GHSA-r735-9gc6-2hvq

Cross-site Scripting (XSS) in janeczku/calibre-web

MEDIUM 60

A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0038 Published 2024-11-15 Fixed in 0.6.15 CWE-79

TI-2024-26178 CVE-2024-39123 · GHSA-j22r-3rf3-cv25

In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to…

MEDIUM 58

In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the clean_string function.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.23069 Published 2024-07-19 No fix listed CWE-79

TI-2021-07970 CVE-2021-25964 · GHSA-8gr4-jgmh-5g8w

Stored Cross-Site Scripting (XSS) in Calibre-web via Description Field in Metadata

MEDIUM 58

In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00549 Published 2021-10-04 No fix listed CWE-79

TI-2026-06791 CVE-2026-7709 · GHSA-6xgw-x2hr-63c2

janeczku Calibre-Web Endpoint kobo_auth.py generate_auth_token improper authorization

MEDIUM 57

A vulnerability was identified in janeczku Calibre-Web up to 0.6.26.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00219 Published 2026-05-03 No fix listed CWE-266

TI-2021-02884 CVE-2021-3987 · GHSA-fj5v-w2jp-wqvj

Improper Access Control in janeczku/calibre-web

MEDIUM 53

An improper access control vulnerability exists in janeczku/calibre-web.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00346 Published 2024-11-15 Fixed in 0.6.15 CWE-284

TI-2021-02883 CVE-2021-3986 · GHSA-m982-h4f8-g4hf

Information Disclosure in janeczku/calibre-web

MEDIUM 53

A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00371 Published 2024-11-15 Fixed in 0.6.15 CWE-209

TI-2022-00838 CVE-2022-0939 · GHSA-fmpq-9gp5-89f5

Server-Side Request Forgery (SSRF) in janeczku/calibre-web

MEDIUM 45

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.

CVSS 3.1CRITICAL 9.9 Network No auth No interaction EPSS 0.01059 Published 2022-04-04 Fixed in 0.6.18 CWE-918

TI-2022-00676 CVE-2022-0766 · GHSA-2647-c639-qv2j

Server-Side Request Forgery (SSRF) in janeczku/calibre-web

MEDIUM 45

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01315 Published 2022-03-07 Fixed in 0.6.17 CWE-918

TI-2021-03039 CVE-2021-4171 · GHSA-xp7p-3gx7-j6wx

Business Logic Errors in janeczku/calibre-web

MEDIUM 45

calibre-web is vulnerable to Business Logic Errors

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01387 Published 2022-01-17 Fixed in 0.6.15 CWE-840

TI-2020-10044 CVE-2020-12627 · GHSA-9q6c-4f46-hgf2

Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN]LWX/,?RT' hardcoded secret key.

MEDIUM 45

Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN]LWX/,?RT' hardcoded secret key.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01368 Published 2020-05-04 No fix listed CWE-798

TI-2022-12897 CVE-2022-30765 · GHSA-8ppf-x4gr-2x7g

Calibre-Web before 0.6.18 allows user table SQL Injection.

MEDIUM 44

Calibre-Web before 0.6.18 allows user table SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01207 Published 2022-05-16 Fixed in 0.6.18 CWE-89

TI-2022-00677 CVE-2022-0767 · GHSA-h65g-jfqg-2w6m

Server-Side Request Forgery (SSRF) in janeczku/calibre-web

MEDIUM 44

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.

CVSS 3.1CRITICAL 9.9 Network No auth No interaction EPSS 0.00985 Published 2022-03-07 Fixed in 0.6.17 CWE-918

TI-2022-00266 CVE-2022-0339 · GHSA-4w8p-x6g8-fv64

Server-Side Request Forgery (SSRF) in janeczku/calibre-web

MEDIUM 44

Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00962 Published 2022-01-30 Fixed in 0.6.16 CWE-918

TI-2022-00889 CVE-2022-0990 · GHSA-v9rf-4g2w-68jc

Server-Side Request Forgery (SSRF) in janeczku/calibre-web

MEDIUM 42

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01337 Published 2022-04-04 Fixed in 0.6.18 CWE-918

TI-2021-03034 CVE-2021-4164 · GHSA-wxr6-29pv-ch68

Cross-Site Request Forgery (CSRF) in janeczku/calibre-web

LOW 39

calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00545 Published 2022-01-17 Fixed in 0.6.15 CWE-352

TI-2022-00207 CVE-2022-0273 · GHSA-vgmw-9cww-qq99

Improper Access Control in janeczku/calibre-web

LOW 30

Improper Access Control in Pypi calibreweb prior to 0.6.16.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0067 Published 2022-01-30 Fixed in 0.6.16 CWE-284

TI-2022-00278 CVE-2022-0352 · GHSA-h56g-v4vp-q9q6

Cross-site Scripting (XSS) - Reflected in janeczku/calibre-web

LOW 29

Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00853 Published 2022-01-28 Fixed in 0.6.16 CWE-79

TI-2021-03038 CVE-2021-4170 · GHSA-wrp6-9w7f-3wxg

Cross-site Scripting (XSS) - Stored in janeczku/calibre-web

LOW 26

calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00809 Published 2022-01-16 Fixed in 0.6.15 CWE-79

TI-2022-00331 CVE-2022-0406 · GHSA-f47h-hr72-5959

Improper Authorization in janeczku/calibre-web

LOW 21

Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00663 Published 2022-04-03 Fixed in 0.6.16 CWE-285

TI-2022-00330 CVE-2022-0405 · GHSA-gqcj-xp3p-vqqj

Improper Access Control in janeczku/calibre-web

LOW 21

Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00759 Published 2022-04-03 Fixed in 0.6.16 CWE-284

TI-2025-40487 CVE-2025-65858 · GHSA-pc5g-j9j7-p4q3

A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers…

LOW 16

A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation.

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00221 Published 2025-12-02 No fix listed CWE-79

Open these records in search →