351 matches found
Cross-site Scripting (XSS) - Stored in janeczku/calibre-web
💥 BUG stored xss via book description 💥 STEP TO REPRODUCE Lets there is two user Admin and user-B . user-B has edit permission in book.\ \ 1. Now goto user-B account and visit http://localhost:8083/admin/book/12 and edit the metadata .\ During edit put bellow xss payload in book Description field...
Cross-Site Request Forgery (CSRF) in janeczku/calibre-web
✍️ Description An attacker can make a user change his profile settings by CSRF vulnerability through PoC file. There is no CSRF token. 🕵️♂️ Proof of Concept For example, changing the email address from "[email protected]" to "[email protected]" test1's profile. Make the user open a link with this page...
Calibre-Web Authorization Issues Vulnerability
Calibre-Web is a web application for browsing, reading and downloading eBooks from the Calibre database. An authorization issue vulnerability exists in Calibre-Web version 0.6.6, which stems from the program's use of a hard-coded secret key that can be exploited by an attacker to bypass...
CVE-2020-12627
Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX RXHH!jmNLWX/,?RT' hardcoded secret key...
CVE-2020-12627
Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX RXHH!jmNLWX/,?RT' hardcoded secret key...
Hardcoded credentials
Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX RXHH!jmNLWX/,?RT' hardcoded secret key...
CVE-2020-12627
Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX RXHH!jmNLWX/,?RT' hardcoded secret key...
CVE-2020-12627
CVE-2020-12627 affects Calibre-Web 0.6.6 (Calibre-Web) and is caused by a hardcoded secret key ('A0Zr98j/3yX R~XHH!jmN]LWX/,?RT'), enabling authentication bypass. The Red Hat, CNVD, OSV, NVD, and CVE records consistently identify the same issue and impact. Documented impact is authentication bypa...
CVE-2020-12627
Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX RXHH!jmNLWX/,?RT' hardcoded secret key...
PT-2020-13173 · Calibre · Calibre-Web
Name of the Vulnerable Software and Affected Versions: Calibre-Web version 0.6.6 Description: The issue allows authentication bypass due to a hardcoded secret key 'A0Zr98j/3yX RXHH!jmNLWX/,?RT'. Recommendations: For Calibre-Web version 0.6.6, update the secret key to a unique and secure value to...
