Janeczku Calibre-web — known CVE vulnerabilities

Every CVE whose affected-product data names Janeczku Calibre-web, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (24)

• CVE-2022-0767 — CVSS 9.9 (critical): Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.
• CVE-2022-0939 — CVSS 9.9 (critical): Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.
• CVE-2020-12627 — CVSS 9.8 (critical): Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN]LWX/,?RT' hardcoded secret key.
• CVE-2021-4171 — CVSS 9.8 (critical): calibre-web is vulnerable to Business Logic Errors
• CVE-2022-0339 — CVSS 9.8 (critical): Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.
• CVE-2022-0766 — CVSS 9.8 (critical): Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.
• CVE-2022-2525 — CVSS 9.8 (critical): Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20.
• CVE-2022-30765 — CVSS 9.8 (critical): Calibre-Web before 0.6.18 allows user table SQL Injection.
• CVE-2023-2106 — CVSS 9.8 (critical): Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20.
• CVE-2025-7404 — CVSS 9.8 (critical): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows…
• CVE-2022-0990 — CVSS 9.1 (critical): Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.
• CVE-2021-25965 — CVSS 8.8 (high): In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF). By luring an authenticated user to click on a…
• CVE-2021-4164 — CVSS 8.8 (high): calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
• CVE-2022-0273 — CVSS 6.5 (medium): Improper Access Control in Pypi calibreweb prior to 0.6.16.
• CVE-2021-3988 — CVSS 6.1 (medium): A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability…
• CVE-2022-0352 — CVSS 6.1 (medium): Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.
• CVE-2021-25964 — CVSS 5.4 (medium): In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”. An attacker that has access to edit…
• CVE-2021-4170 — CVSS 5.4 (medium): calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CVE-2024-39123 — CVSS 5.4 (medium): In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper…
• CVE-2021-3986 — CVSS 4.3 (medium): A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue…
• CVE-2022-0405 — CVSS 4.3 (medium): Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.
• CVE-2022-0406 — CVSS 4.3 (medium): Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.
• CVE-2021-3987 — CVSS 4.3 (medium): An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions…
• CVE-2025-65858 — CVSS 3.5 (low): A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the…