CVE-2025-55165 Autocaliweb Exposure of Sensitive Information to an Unauthorized Actor in `config_sql.py`

Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This occurs because the todict method, used ...

CVE-2025-7404

CVE-2025-7404 concerns Calibre Web (and Autocaliweb) with a blind OS command injection due to improper neutralization of input in OS commands. Affected: Calibre Web 0.6.24; Autocaliweb 0.7.0–before 0.7.1. Root cause: insufficient sanitization of user input enabling remote command execution via th...

PT-2025-30695 · Unknown · Autocaliweb +1

Name of the Vulnerable Software and Affected Versions: Calibre Web version 0.6.24 Nicolette Autocaliweb version 0.7.0 Description: A Regular Expression Denial of Service ReDoS issue exists in the strip whitespaces function within cps/string helper.py. Unauthenticated remote attackers can exploit...