CVSS 3.1
5.4 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVE-2021-4170
Medium (5.4) in janeczku calibre-web. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in calibreweb 0.6.15.
calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- janeczku:calibre-web
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-wrp6-9w7f-3wxg | PyPI | calibreweb | <0.6.15 | 0.6.15 |
| PYSEC-2026-620 | PyPI | calibreweb | <0.6.15 | 0.6.15 |
References
- https://github.com/janeczku/calibre-web/commit/7ad419dc8c12180e842a82118f4866ac3d074bc5
- https://huntr.dev/bounties/ff395101-e392-401d-ab4f-579c63fbf6a0
- https://github.com/janeczku/calibre-web/commit/7ad419dc8c12180e842a82118f4866ac3d074bc5
- https://huntr.dev/bounties/ff395101-e392-401d-ab4f-579c63fbf6a0