CVE-2021-3987 Improper Access Control in janeczku/calibre-web

An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the createshelf method in shelf.py not verifying if the user has the necessary permissions to create a...

CVE-2021-3987

CVE-2021-3987 (janeczku/calibre-web) is an improper access control flaw where the public shelf creation path (shelf.py: create_shelf) does not verify user permissions, allowing low-privilege users to create public shelves and perform unauthorized actions. Public disclosures in multiple feeds corr...

CVE-2021-3987 Improper Access Control in janeczku/calibre-web

An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the createshelf method in shelf.py not verifying if the user has the necessary permissions to create a...

CVE-2021-3986

The CVE-2021-3986 issue in janeczku/calibre-web is a data exposure vulnerability where an unauthorized user can view the names of private shelves. It occurs in shelf.py at line 221, exposing the shelf name in an error message when a non-owner tries to remove a book. This affects all versions prio...

CVE-2021-3986 Information Disclosure in janeczku/calibre-web

A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they d...

CVE-2021-3986 Information Disclosure in janeczku/calibre-web

A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they d...

CVE-2021-3986

A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they d...

PT-2024-11004

Name of the Vulnerable Software and Affected Versions janeczku/calibre-web affected versions not specified Description An improper access control issue exists, allowing users without public shelf permissions to create public shelves. This is due to the create shelf method in shelf.py not verifyin...

Calibre-Web 跨站脚本漏洞

Calibre-Web is a web application for browsing, reading, and downloading eBooks from the Calibre database by Jan B, an individual developer. Calibre-Web suffers from a cross-site scripting vulnerability that originates from inserting user input directly into the DOM without proper cleanup. An...

Calibre-Web 访问控制错误漏洞

Calibre-Web is a web application for browsing, reading, and downloading eBooks from the Calibre database by Jan B, an individual developer. An access control error vulnerability exists in Calibre-Web that stems from the createshelf method in shelf.py not verifying that a user has the required...

CVE-2021-3987: Improper Access Control

An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the createshelf method in shelf.py not verifying if the user has the necessary permissions to create a...

CVE-2021-3986: Generation of Error Message Containing Sensitive Information

A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they d...

CVE-2021-3988: Improper Neutralization of Input During Web Page Generation

A Cross-site Scripting XSS vulnerability exists in janeczku/calibre-web, specifically in the file editbooks.js. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization,...

PT-2024-11003

Name of the Vulnerable Software and Affected Versions janeczku/calibre-web versions prior to the fix Description A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, whe...

Calibre-Web 安全漏洞

Calibre-Web is a web application for browsing, reading, and downloading eBooks from the Calibre database by Jan B Individual Developer. A security vulnerability exists in Calibre-Web that originates from allowing unauthorized users to view the names of private bookshelves belonging to other users...

Calibre Web 0.6.21 Cross Site Scripting

Exploit Title: Stored XSS in Calibre-web Date: 07/05/2024 Exploit Authors: Pentest-Tools.com Catalin Iovita & Alexandru Postolache Vendor Homepage: https://github.com/janeczku/calibre-web/ Version: 0.6.21 - Romesa Tested on: Linux 5.15.0-107, Python 3.10.12, lxml 4.9.4 CVE: CVE-2024-39123...

Calibre-web 0.6.21 - Stored XSS Vulnerability

Exploit Title: Stored XSS in Calibre-web Exploit Authors: Pentest-Tools.com Catalin Iovita & Alexandru Postolache Vendor Homepage: https://github.com/janeczku/calibre-web/ Version: 0.6.21 - Romesa Tested on: Linux 5.15.0-107, Python 3.10.12, lxml 4.9.4 CVE: CVE-2024-39123 Vulnerability Descriptio...

Calibre-web 0.6.21 - Stored XSS

Exploit Title: Stored XSS in Calibre-web Date: 07/05/2024 Exploit Authors: Pentest-Tools.com Catalin Iovita & Alexandru Postolache Vendor Homepage: https://github.com/janeczku/calibre-web/ Version: 0.6.21 - Romesa Tested on: Linux 5.15.0-107, Python 3.10.12, lxml 4.9.4 CVE: CVE-2024-39123...

Cross Site Scripting(XSS)

Calibre-Web is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper sanitization performed by the cleanstring function, which allows an attacker perform XSS by inserting a payload into the comments field...

Calibre-Web Cross Site Scripting (XSS)

In janeczku Calibre-Web 0.6.0 to 0.6.21, the editbookcomments function is vulnerable to Cross Site Scripting XSS due to improper sanitization performed by the cleanstring function. The vulnerability arises from the way the cleanstring function handles HTML sanitization...