CVE-2024-6782-PoC

CVE-2024-6782-PoC Usage: python3 callibre.py --target http://target:8080/ Unauthenticated remote code execution via Calibre’s content server in Calibre = 7.14.0...

CVE-2024-6782

CVE-2024-6782 Calibre Remote Code Execution CVE-2024-6782 Improper access control in Calibre 6.9.0 7.14.0 allow unauthenticated attackers to achieve remote code execution...

Calibre <= 7.14.0 Arbitrary File Read

Arbitrary file read via Calibre’s content server in Calibre = 7.14.0. id: CVE-2024-6781 info: name: Calibre = 7.14.0 Arbitrary File Read author: DhiyaneshDK severity: high description: | Arbitrary file read via Calibre’s content server in Calibre = 7.14.0. impact: | Attackers can exploit the...

Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS)

It is possible to inject arbitrary JavaScript code into the /browse endpoint of the Calibre content server, allowing an attacker to craft a URL that when clicked by a victim, will execute the attacker’s JavaScript code in the context of the victim’s browser. If the Calibre server is running with...

CVE-2024-39123-Exploit

CVE-2024-39123：Calibre-web 0.6.21 中的存储型 XSS 漏洞 漏洞利用详情 漏洞利用标题 ：Calibre-web 中的存储型 XSS 漏洞 日期 ：2024-05-07 漏洞利用作者 ：Catalin Iovita & Alexandru Postolache Pentest-Tools.com 厂商主页 ：Calibre-web GitHub 仓库 版本 ：0.6.21 - Romesa 测试环境 ：Linux 5.15.0-107、Python 3.10.12、lxml 4.9.4 CVE ：CVE-2024-39123 漏洞描述 Calibre-w...

CVE-2026-25731

Templite 引擎中的服务端模板注入（SSTI） 严重性： 高危（CVSS 7.8） 受影响软件： calibre 修复版本： 9.2.0 安全公告： GHSA-xrh9-w7qx-3gcc 概述 Calibre 的 Templite 模板引擎中存在一个服务端模板注入（SSTI）漏洞，当用户通过 --template-html 或 --template-html-index 命令行选项使用恶意自定义模板文件转换电子书时，该漏洞允许任意代码执行。 详细信息 Templite 引擎（src/templite/init.py）使用 Python 的 compile 和 eval...

calibre-web-CVE-2025-65858

This repository does not have a README...

CVE-2024-6782

CVE-2024-6782 Improper access control in Calibre 6.9.0 7.14.0 allow unauthenticated attackers to achieve remote code execution. It's a simpler version lol...

Calibre <= 7.14.0 Remote Code Execution

Unauthenticated remote code execution via Calibre’s content server in Calibre = 7.14.0. id: CVE-2024-6782 info: name: Calibre = 7.14.0 Remote Code Execution author: DhiyaneshDK severity: critical description: | Unauthenticated remote code execution via Calibre’s content server in Calibre = 7.14.0...

[SECURITY] Fedora 45 Update: calibre-9.14.0-3.fc45

Calibre is meant to be a complete e-library solution. It includes library management, format conversion, news feeds to ebook conversion as well as e-book reader sync features. Calibre is primarily a ebook cataloging program. It manages your ebook collection for you. It is designed around the...

[SECURITY] Fedora 44 Update: calibre-9.13.0-1.fc44

Calibre is meant to be a complete e-library solution. It includes library management, format conversion, news feeds to ebook conversion as well as e-book reader sync features. Calibre is primarily a ebook cataloging program. It manages your ebook collection for you. It is designed around the...

Fedora 44 : calibre (2026-9f2b45e4c1)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9f2b45e4c1 advisory. Update to 9.13.0. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

[SECURITY] Fedora 43 Update: calibre-9.13.0-1.fc43

Calibre is meant to be a complete e-library solution. It includes library management, format conversion, news feeds to ebook conversion as well as e-book reader sync features. Calibre is primarily a ebook cataloging program. It manages your ebook collection for you. It is designed around the...

Fedora 43 : calibre (2026-c10ed2f3b7)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c10ed2f3b7 advisory. Update to 9.13.0. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

[SECURITY] [DLA 4744-1] calibre security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4744-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA August 18, 2026 https://wiki.debian.org/LTS -...

Debian dla-4744 : calibre - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4744 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4744-1 [email protected]...

SUSE CVE-2026-73248

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled compositetemplate metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template call whose formatter does not inherit allowpythontemplates=False, allowing a nested python:...

SUSE CVE-2026-73249

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...

CVE-2026-73248

A flaw was found in calibre, an e-book manager. A remote attacker could craft a malicious e-book file such as EPUB, OPF, or PDF containing specially crafted metadata. When a user opens or imports this file, the application's processing of nested templates can bypass Python template restrictions,...

CVE-2026-73249

A flaw was found in the calibre Content Server. This vulnerability allows a remote attacker, including unauthenticated users, to bypass authorization checks when interacting with the /book-update-annotations endpoint. By sending specially crafted JSON data, an attacker can modify book annotations...