Janeczku Calibre-Web vulnerabilities

CVE-2025-7404 [CRITICAL] CWE-78 CVE-2025-7404: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.

CVE-2024-39123 [MEDIUM] CWE-79 CVE-2024-39123: In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the clean_string function. The vulnerability arises from the way the clean_string function handles HTML sanitization.

CVE-2020-12627 [CRITICAL] CWE-798 CVE-2020-12627: Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN]LWX/,?RT' hardc Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN]LWX/,?RT' hardcoded secret key.

CVE-2022-30765 [CRITICAL] CWE-89 CVE-2022-30765: Calibre-Web before 0.6.18 allows user table SQL Injection. Calibre-Web before 0.6.18 allows user table SQL Injection.

CVE-2022-0990 [CRITICAL] CWE-918 CVE-2022-0990: Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18. Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.

CVE-2022-0939 [CRITICAL] CWE-918 CVE-2022-0939: Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18. Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.

CVE-2022-0766 [CRITICAL] CWE-918 CVE-2022-0766: Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17. Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.

CVE-2022-0767 [CRITICAL] CWE-918 CVE-2022-0767: Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17. Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.

CVE-2022-2525 [CRITICAL] CWE-307 CVE-2022-2525: Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20.

CVE-2021-4171 [CRITICAL] CWE-840 CVE-2021-4171: calibre-web is vulnerable to Business Logic Errors calibre-web is vulnerable to Business Logic Errors

CVE-2022-0339 [CRITICAL] CWE-918 CVE-2022-0339: Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16. Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.

CVE-2026-7709 [MEDIUM] CWE-266 CVE-2026-7709: A vulnerability was identified in janeczku Calibre-Web up to 0.6.26. The impacted element is the fun A vulnerability was identified in janeczku Calibre-Web up to 0.6.26. The impacted element is the function generate_auth_token of the file cps/kobo_auth.py of the component Endpoint. Such manipulation of the argument user_id leads to improper authorization. The attack may be launched remotely. The exploit is publicly available and might be used. The ve

CVE-2023-2106 [CRITICAL] CWE-521 CVE-2023-2106: Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20. Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20.

CVE-2021-25965 [HIGH] CWE-352 CVE-2021-25965: In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF). By lur In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF). By luring an authenticated user to click on a link, an attacker can create a new user role with admin privileges and attacker-controlled credentials, allowing them to take over the application.

CVE-2021-4164 [HIGH] CWE-352 CVE-2021-4164: calibre-web is vulnerable to Cross-Site Request Forgery (CSRF) calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)

CVE-2022-0273 [MEDIUM] CWE-284 CVE-2022-0273: Improper Access Control in Pypi calibreweb prior to 0.6.16. Improper Access Control in Pypi calibreweb prior to 0.6.16.

CVE-2021-3988 [MEDIUM] CWE-79 CVE-2021-3988: A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization, allowing attackers to execute arbitrary JavaScript code.

CVE-2021-25964 [MEDIUM] CWE-79 CVE-2021-25964: In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”. An atta In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”. An attacker that has access to edit the metadata information, can inject JavaScript payload in the description field. When a victim tries to open the file, XSS will be triggered.

CVE-2022-0352 [MEDIUM] CWE-79 CVE-2022-0352: Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16. Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.

CVE-2021-4170 [MEDIUM] CWE-79 CVE-2021-4170: calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-sit calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')