Calibre Web and Autocaliweb have OS Command Injection vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2025-7404 · ADVISORY
• fluidattacks.com/advisories/kino · WEB
• gelbphoenix/autocaliweb · WEB
• janeczku/calibre-web · WEB
• pypi.org/project/calibreweb · PACKAGE
• GitHub Advisory GHSA-qc4j-v7h6-xr5h · ADVISORY

calibreweb のその他の脆弱性

• CVE-2025-65858低 3.5A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username'…
• CVE-2025-6998高 8.7ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to caus…
• CVE-2021-3988中 6.1A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occur…
• CVE-2021-3987中 4.3An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions …
• CVE-2021-3986中 4.3A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue …