Описание
A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed.
Ссылки
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:janeczku:calibre-web:0.6.25:*:*:*:*:*:*:*
EPSS
Процентиль: 8%
0.0003
Низкий
3.5 Low
CVSS3
Дефекты
CWE-79
Связанные уязвимости
CVSS3: 3.5
debian
2 месяца назад
A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6. ...
github
2 месяца назад
Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation
EPSS
Процентиль: 8%
0.0003
Низкий
3.5 Low
CVSS3
Дефекты
CWE-79