CVE-2025-7404

Опубликовано: 24 июл. 2025

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.

Ссылки

https://fluidattacks.com/advisories/kino
Exploit
Third Party Advisory
https://github.com/gelbphoenix/autocaliweb
Release Notes
https://github.com/janeczku/calibre-web
Product
https://fluidattacks.com/advisories/kino
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:gelbphoenix:autocaliweb:0.7.0:*:*:*:*:*:*:*

cpe:2.3:a:janeczku:calibre-web:0.6.24:*:*:*:*:*:*:*

EPSS

Процентиль: 57%

0.00355

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-78

Связанные уязвимости

CVE-2025-7404

CVSS3: 9.8

debian

7 месяцев назад

Improper Neutralization of Special Elements used in an OS Command ('OS ...

GHSA-qc4j-v7h6-xr5h

github