En bref
- CVE-2025-65858 est une vulnérabilité FAIBLE (CVSS 3.5) touchant calibreweb, calibre-web (janeczku).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.21%, plus élevée que 10.6% des vulnérabilités.
- Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.
Description
A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed.
NVD description
A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free