CVE-2026-7709 | Medium | 6.3 | 2026-05-03 | A vulnerability was identified in janeczku Calibre-Web up to 0.6.26. The impacted element is the function generate_auth_token of the file cps/kobo_auth.py of t… |
CVE-2025-65858 | Low | 3.5 | 2025-12-02 | A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user… |
CVE-2025-7404 | Critical | 9.8 | 2025-07-24 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command In… |
CVE-2021-3988 | Medium | 6.1 | 2024-11-15 | A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occurs when editing book… |
CVE-2021-3987 | Medium | 4.3 | 2024-11-15 | An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public sh… |
CVE-2021-3986 | Medium | 4.3 | 2024-11-15 | A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file… |
CVE-2024-39123 | Medium | 5.4 | 2024-07-19 | In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by… |
CVE-2023-2106 | Critical | 9.8 | 2023-04-15 | Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20. |
CVE-2022-2525 | Critical | 9.8 | 2023-04-15 | Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20. |
CVE-2022-30765 | Critical | 9.8 | 2022-05-16 | Calibre-Web before 0.6.18 allows user table SQL Injection. |
CVE-2022-0990 | Critical | 9.1 | 2022-04-04 | Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18. |
CVE-2022-0939 | Critical | 9.9 | 2022-04-04 | Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18. |
CVE-2022-0406 | Medium | 4.3 | 2022-04-03 | Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16. |
CVE-2022-0405 | Medium | 4.3 | 2022-04-03 | Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16. |
CVE-2022-0767 | Critical | 9.9 | 2022-03-07 | Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17. |
CVE-2022-0766 | Critical | 9.8 | 2022-03-07 | Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17. |
CVE-2022-0339 | Critical | 9.8 | 2022-01-30 | Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16. |
CVE-2022-0273 | Medium | 6.5 | 2022-01-30 | Improper Access Control in Pypi calibreweb prior to 0.6.16. |
CVE-2022-0352 | Medium | 6.1 | 2022-01-28 | Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16. |
CVE-2021-4164 | High | 8.8 | 2022-01-17 | calibre-web is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-4171 | Critical | 9.8 | 2022-01-17 | calibre-web is vulnerable to Business Logic Errors |
CVE-2021-4170 | Medium | 5.4 | 2022-01-16 | calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-25965 | High | 8.8 | 2021-11-16 | In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF). By luring an authenticated user to click on a link, an attacker c… |
CVE-2021-25964 | Medium | 5.4 | 2021-10-04 | In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”. An attacker that has access to edit the metadata information, can… |
CVE-2020-12627 | Critical | 9.8 | 2020-05-04 | Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN]LWX/,?RT' hardcoded secret key. |