CA
Product
Calibre-Web
25
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 11High 2Medium 11Low 1
Watch
Add Calibre-Web to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-0939 | 9.9 | Apr 4 | Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18 Affected: before 0.6.18 |
| CVE-2022-0767 | 9.9 | Mar 7 | Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17 Affected: before 0.6.17 |
| CVE-2025-7404 | 9.8 | Jul 24 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue… Affected: 0.6.24 |
| CVE-2023-2106 | 9.8 | Apr 15 | Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20 Affected: before 0.6.20 |
| CVE-2022-2525 | 9.8 | Apr 15 | Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20 Affected: before 0.6.20 |
| CVE-2022-30765 | 9.8 | May 16 | Calibre-Web before 0.6.18 allows user table SQL Injection Affected: 0.6.18 |
| CVE-2022-0766 | 9.8 | Mar 7 | Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17 Affected: before 0.6.17 |
| CVE-2022-0339 | 9.8 | Jan 30 | Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16 Affected: before 0.6.16 |
| CVE-2021-4171 | 9.8 | Jan 17 | calibre-web is vulnerable to Business Logic Errors Affected: before 0.6.15 |
| CVE-2020-12627 | 9.8 | May 4 | Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN]LWX/,?RT' hardcoded secret key Affected: 0.6.6 |
| CVE-2022-0990 | 9.1 | Apr 4 | Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18 Affected: before 0.6.18 |
| CVE-2021-4164 | 8.8 | Jan 17 | calibre-web is vulnerable to Cross-Site Request Forgery (CSRF) Affected: before 0.6.15 |
| CVE-2021-25965 | 8.8 | Nov 16 | In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF) Affected: 0.6.0 through 0.6.13 |
| CVE-2022-0273 | 6.5 | Jan 30 | Improper Access Control in Pypi calibreweb prior to 0.6.16 Affected: before 0.6.16 |
| CVE-2026-7709 | 6.3 | May 3 | janeczku Calibre-Web Endpoint kobo_auth.py generate_auth_token improper authorization Affected: 0.6.0; 0.6.1; 0.6.2; 0.6.3; 0.6.4; 0.6.5; +21 more |
| CVE-2021-3988 | 6.1 | Nov 15 | A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js` Affected: before 0.6.15 |
| CVE-2022-0352 | 6.1 | Jan 28 | Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16 Affected: before 0.6.16 |
| CVE-2024-39123 | 5.4 | Jul 19 | In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the clean_string… Affected: 0.6.0 through 0.6.21 |
| CVE-2021-4170 | 5.4 | Jan 16 | calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected: before 0.6.15 |
| CVE-2021-25964 | 5.4 | Oct 4 | In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata” Affected: 0.6.0 before 0.6.12 |
| CVE-2021-3987 | 4.3 | Nov 15 | An improper access control vulnerability exists in janeczku/calibre-web Affected: before 0.6.15 |
| CVE-2021-3986 | 4.3 | Nov 15 | A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users Affected: before 0.6.15 |
| CVE-2022-0406 | 4.3 | Apr 3 | Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16 Affected: before 0.6.16 |
| CVE-2022-0405 | 4.3 | Apr 3 | Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16 Affected: before 0.6.16 |
| CVE-2025-65858 | 3.5 | Dec 2 | A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation Affected: 0.6.25 |
Showing 25