Vulnerability Details CVE-2021-25964
In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”. An attacker that has access to edit the metadata information, can inject JavaScript payload in the description field. When a victim tries to open the file, XSS will be triggered.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 43.1%
CVSS Severity
CVSS v3 Score 5.4
CVSS v2 Score 3.5
References
- https://github.com/janeczku/calibre-web/commit/32e27712f0f71fdec646add20cd78b4ce75acfce
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25964
- https://github.com/janeczku/calibre-web/commit/32e27712f0f71fdec646add20cd78b4ce75acfce
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25964
Products affected by CVE-2021-25964
-
cpe:2.3:a:janeczku:calibre-web:0.6.0
-
cpe:2.3:a:janeczku:calibre-web:0.6.10
-
cpe:2.3:a:janeczku:calibre-web:0.6.11
-
cpe:2.3:a:janeczku:calibre-web:0.6.2
-
cpe:2.3:a:janeczku:calibre-web:0.6.3
-
cpe:2.3:a:janeczku:calibre-web:0.6.4
-
cpe:2.3:a:janeczku:calibre-web:0.6.5
-
cpe:2.3:a:janeczku:calibre-web:0.6.6
-
cpe:2.3:a:janeczku:calibre-web:0.6.7
-
cpe:2.3:a:janeczku:calibre-web:0.6.8
-
cpe:2.3:a:janeczku:calibre-web:0.6.9