Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-65858 · ADVISORY
• KhanhDuy155/calibre-web-CVE-2025-65858 · WEB
• janeczku/calibre-web · PACKAGE
• pypi.org/project/calibreweb · PACKAGE
• GitHub Advisory GHSA-pc5g-j9j7-p4q3 · ADVISORY

Weitere Schwachstellen in calibreweb

• CVE-2025-7404KRITISCH 9.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows …
• CVE-2025-6998HOCH 8.7ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to caus…
• CVE-2021-3988MITTEL 6.1A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occur…
• CVE-2021-3987MITTEL 4.3An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions …
• CVE-2021-3986MITTEL 4.3A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue …