Homepage

calibreweb@0.6.18 vulnerabilities

Web app for browsing, reading and downloading eBooks stored in a Calibre database.

  • latest version

    0.6.24

  • latest non vulnerable version

    0.6.24

  • first published

    3 years ago

  • latest version published

    5 months ago

  • licenses detected

  • View calibreweb package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the calibreweb package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Cross-site Scripting (XSS)

    calibreweb is a Web app for browsing, reading and downloading eBooks stored in a Calibre database.

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in the edit_book_comments function. An attacker can inject malicious scripts by exploiting the inadequate HTML sanitization performed by the clean_string function.

    How to fix Cross-site Scripting (XSS)?

    Upgrade calibreweb to version 0.6.22 or higher.

    [,0.6.22)
    • H
    Weak Password Requirements

    calibreweb is a Web app for browsing, reading and downloading eBooks stored in a Calibre database.

    Affected versions of this package are vulnerable to Weak Password Requirements due to missing rate limits in the login functionality.

    How to fix Weak Password Requirements?

    Upgrade calibreweb to version 0.6.20 or higher.

    [,0.6.20)
    • H
    Brute Force

    calibreweb is a Web app for browsing, reading and downloading eBooks stored in a Calibre database.

    Affected versions of this package are vulnerable to Brute Force due to missing rate limiting in login form.

    How to fix Brute Force?

    Upgrade calibreweb to version 0.6.20 or higher.

    [,0.6.20)
    Go back to all versions of this package