low1.9
CVE-2025-65858
Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation
Impact
A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | calibreweb | <= 0.6.25 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Janeczku | Calibre-Web | Version 0.6.25 |