Описание
A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed.
Ссылки
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:janeczku:calibre-web:0.6.25:*:*:*:*:*:*:*
EPSS
Процентиль: 11%
0.00206
Низкий
3.5 Low
CVSS3
Дефекты
CWE-79
Связанные уязвимости
CVSS3: 3.5
debian
9 месяцев назад
A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6. ...
github
9 месяцев назад
Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation
EPSS
Процентиль: 11%
0.00206
Низкий
3.5 Low
CVSS3
Дефекты
CWE-79