GHSA-j22r-3rf3-cv25

ghsaUSosv

Calibre-Web Cross Site Scripting (XSS)

view advisory published 2024-07-19Licence: CC-BY-4.0

In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the clean_string function. The vulnerability arises from the way the clean_string function handles HTML sanitization.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-39123US	—	23.1% (98th)	Exploit	2024-07-19
In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the clean_string func…

references

External citations — patches, advisories, analysis.

https://github.com/janeczku/calibre-webPACKAGE
https://github.com/pentesttoolscom/vulnerability-research/tree/master/CVE-2024-39123WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-39123ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan