> CVE-2025-65858

« BACK_TO_HOME
PUBLISHED
2025-12-02 14:16
MODIFIED
2025-12-02 14:16
EPSS (Prob. Exploit)
0.22%
Top 87.3%
DATA SOURCES:
NVD 🔗 2025-12-02 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-pc5g-j9j7-p4q3 LOW

Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation

AFFECTED PACKAGES:
PIP / calibreweb
<= 0.6.25

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:
Unknown / Unknown
1 versions affected
ALIASES:
GHSA-pc5g-j9j7-p4q3, PYSEC-2026-1234

> HISTORIQUE DES MODIFICATIONS

Première apparition
02/12/2025 14:16
Source: NVD
📊 ENRICHISSEMENT 19/01/2026 17:37
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 9 months ago

> REFERENCES

https://github.com/KhanhDuy155/calibre-web-CVE-2025-65858/blob/main/CVE-2025-658...
« BACK_TO_HOME