84 matches found
CVE-2025-6998-CalibreWeb-0.6.24-ReDoS
CVE-2025-6998-CalibreWeb-0.6.24-ReDoS Exploit para el ReDoS de CalibreWeb v0.6.24...
CVE-2025-7404-CalibreWeb-0.6.24-BlindCommandInjection
CVE-2025-7404-CalibreWeb-0.6.24-BlindCommandInjection CVE-2025-7404 exploit...
Improper Restriction of Excessive Authentication Attempts in calibreweb
Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20...
Weak Password Requirements in calibreweb
Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20...
PYSEC-2026-1231 Improper Restriction of Excessive Authentication Attempts in calibreweb
Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20...
PYSEC-2026-1233 Weak Password Requirements in calibreweb
Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20...
Server-Side Request Forgery in calibreweb
calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery SSRF. This is a result of incomplete SSRF protection that can be bypassed via an HTTP redirect. An HTTP server set up to respond with a 302 redirect may redirect a request to localhost...
Server-Side Request Forgery in calibreweb
calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery SSRF. This is due to an incomplete fix for CVE-2022-0339. The blacklist does not check for 0.0.0.0, which would result in a payload of 0.0.0.0 resolving to localhost...
PYSEC-2026-304 Server-Side Request Forgery in calibreweb
calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery SSRF. This is due to an incomplete fix for CVE-2022-0339. The blacklist does not check for 0.0.0.0, which would result in a payload of 0.0.0.0 resolving to localhost...
PYSEC-2026-306 Server-Side Request Forgery in calibreweb
calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery SSRF. This is a result of incomplete SSRF protection that can be bypassed via an HTTP redirect. An HTTP server set up to respond with a 302 redirect may redirect a request to localhost...
PT-2026-53400
calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery SSRF. This is a result of incomplete SSRF protection that can be bypassed via an HTTP redirect. An HTTP server set up to respond with a 302 redirect may redirect a request to localhost...
CVE-2022-0339
Server-Side Request Forgery SSRF in Pypi calibreweb prior to 0.6.16...
CVE-2022-0273
Improper Access Control in Pypi calibreweb prior to 0.6.16...
Server-Side Request Forgery
calibreweb is vulnerable to Server-Side Request Forgery. The vulnerability is due to where the blacklist does not check for 0.0.0.0, which would result in a payload of 0.0.0.0 resolving to localhost...
Cross-site Scripting (XSS)
Overview calibreweb is a Web app for browsing, reading and downloading eBooks stored in a Calibre database. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the username field during user creation. An attacker can execute arbitrary JavaScript code in the context of...
EUVD-2022-0034
Malicious code in bioql PyPI...
EUVD-2022-0033
Malicious code in bioql PyPI...
EUVD-2022-0035
Malicious code in bioql PyPI...
Regular Expression Denial of Service (ReDoS)
Overview calibreweb is a Web app for browsing, reading and downloading eBooks stored in a Calibre database. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the stripwhitespaces function in cps/stringhelper.py file. An attacker can cause the...