Vulnerabilities

TI-2026-06791 CVE-2026-7709 · GHSA-6xgw-x2hr-63c2

janeczku Calibre-Web Endpoint kobo_auth.py generate_auth_token improper authorization

MEDIUM 57

A vulnerability was identified in janeczku Calibre-Web up to 0.6.26.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00219 Published 2026-05-03 No fix listed CWE-266

TI-2025-40487 CVE-2025-65858 · GHSA-pc5g-j9j7-p4q3

A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers…

LOW 16

A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation.

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00221 Published 2025-12-02 No fix listed CWE-79

TI-2025-06745 CVE-2025-7404 · GHSA-qc4j-v7h6-xr5h

Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind C

MEDIUM 60

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 (Nicolette); A…

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.02759 Published 2025-07-24 Fixed in 0.7.1 CWE-78

TI-2021-02885 CVE-2021-3988 · GHSA-r735-9gc6-2hvq

Cross-site Scripting (XSS) in janeczku/calibre-web

MEDIUM 60

A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0038 Published 2024-11-15 Fixed in 0.6.15 CWE-79

TI-2021-02884 CVE-2021-3987 · GHSA-fj5v-w2jp-wqvj

Improper Access Control in janeczku/calibre-web

MEDIUM 53

An improper access control vulnerability exists in janeczku/calibre-web.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00346 Published 2024-11-15 Fixed in 0.6.15 CWE-284

TI-2021-02883 CVE-2021-3986 · GHSA-m982-h4f8-g4hf

Information Disclosure in janeczku/calibre-web

MEDIUM 53

A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00371 Published 2024-11-15 Fixed in 0.6.15 CWE-209

TI-2024-26178 CVE-2024-39123 · GHSA-j22r-3rf3-cv25

In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to…

MEDIUM 58

In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the clean_string function.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.23069 Published 2024-07-19 No fix listed CWE-79

TI-2023-01981 CVE-2023-2106 · GHSA-mhmp-m6g7-7c24

Weak Password Requirements in janeczku/calibre-web

HIGH 82

Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00748 Published 2023-04-15 Fixed in 0.6.20 CWE-521

TI-2022-02333 CVE-2022-2525 · GHSA-jg8w-wgx2-g7q4

Improper Restriction of Excessive Authentication Attempts in janeczku/calibre-web

HIGH 82

Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00769 Published 2023-04-15 Fixed in 0.6.20 CWE-307

TI-2022-12897 CVE-2022-30765 · GHSA-8ppf-x4gr-2x7g

Calibre-Web before 0.6.18 allows user table SQL Injection.

MEDIUM 44

Calibre-Web before 0.6.18 allows user table SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01207 Published 2022-05-16 Fixed in 0.6.18 CWE-89

TI-2022-00889 CVE-2022-0990 · GHSA-v9rf-4g2w-68jc

Server-Side Request Forgery (SSRF) in janeczku/calibre-web

MEDIUM 42

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01337 Published 2022-04-04 Fixed in 0.6.18 CWE-918

TI-2022-00838 CVE-2022-0939 · GHSA-fmpq-9gp5-89f5

Server-Side Request Forgery (SSRF) in janeczku/calibre-web

MEDIUM 45

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.

CVSS 3.1CRITICAL 9.9 Network No auth No interaction EPSS 0.01059 Published 2022-04-04 Fixed in 0.6.18 CWE-918

TI-2022-00331 CVE-2022-0406 · GHSA-f47h-hr72-5959

Improper Authorization in janeczku/calibre-web

LOW 21

Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00663 Published 2022-04-03 Fixed in 0.6.16 CWE-285

TI-2022-00330 CVE-2022-0405 · GHSA-gqcj-xp3p-vqqj

Improper Access Control in janeczku/calibre-web

LOW 21

Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00759 Published 2022-04-03 Fixed in 0.6.16 CWE-284

TI-2022-00676 CVE-2022-0766 · GHSA-2647-c639-qv2j

Server-Side Request Forgery (SSRF) in janeczku/calibre-web

MEDIUM 45

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01315 Published 2022-03-07 Fixed in 0.6.17 CWE-918

TI-2022-00677 CVE-2022-0767 · GHSA-h65g-jfqg-2w6m

Server-Side Request Forgery (SSRF) in janeczku/calibre-web

MEDIUM 44

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.

CVSS 3.1CRITICAL 9.9 Network No auth No interaction EPSS 0.00985 Published 2022-03-07 Fixed in 0.6.17 CWE-918

TI-2022-00207 CVE-2022-0273 · GHSA-vgmw-9cww-qq99

Improper Access Control in janeczku/calibre-web

LOW 30

Improper Access Control in Pypi calibreweb prior to 0.6.16.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0067 Published 2022-01-30 Fixed in 0.6.16 CWE-284

TI-2022-00266 CVE-2022-0339 · GHSA-4w8p-x6g8-fv64

Server-Side Request Forgery (SSRF) in janeczku/calibre-web

MEDIUM 44

Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00962 Published 2022-01-30 Fixed in 0.6.16 CWE-918

TI-2022-00278 CVE-2022-0352 · GHSA-h56g-v4vp-q9q6

Cross-site Scripting (XSS) - Reflected in janeczku/calibre-web

LOW 29

Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00853 Published 2022-01-28 Fixed in 0.6.16 CWE-79

TI-2021-03034 CVE-2021-4164 · GHSA-wxr6-29pv-ch68

Cross-Site Request Forgery (CSRF) in janeczku/calibre-web

LOW 39

calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00545 Published 2022-01-17 Fixed in 0.6.15 CWE-352

TI-2021-03039 CVE-2021-4171 · GHSA-xp7p-3gx7-j6wx

Business Logic Errors in janeczku/calibre-web

MEDIUM 45

calibre-web is vulnerable to Business Logic Errors

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01387 Published 2022-01-17 Fixed in 0.6.15 CWE-840

TI-2021-03038 CVE-2021-4170 · GHSA-wrp6-9w7f-3wxg

Cross-site Scripting (XSS) - Stored in janeczku/calibre-web

LOW 26

calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00809 Published 2022-01-16 Fixed in 0.6.15 CWE-79

TI-2021-07971 CVE-2021-25965 · GHSA-v5hx-2wwf-52wx

Calibre-web - Admin Account Takeover via Cross-Site Request Forgery (CSRF)

HIGH 73

In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00527 Published 2021-11-16 No fix listed CWE-352

TI-2021-07970 CVE-2021-25964 · GHSA-8gr4-jgmh-5g8w

Stored Cross-Site Scripting (XSS) in Calibre-web via Description Field in Metadata

MEDIUM 58

In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00549 Published 2021-10-04 No fix listed CWE-79

TI-2020-10044 CVE-2020-12627 · GHSA-9q6c-4f46-hgf2

Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN]LWX/,?RT' hardcoded secret key.

MEDIUM 45

Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN]LWX/,?RT' hardcoded secret key.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01368 Published 2020-05-04 No fix listed CWE-798

Vulnerabilities

Filters