IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-07-24 20:15

MODIFIED

2025-07-25 15:29

EPSS (Prob. Exploit)

0.96%

Top 38.3%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-11 OSV 🔗 2026-11-08

> DESCRIPTION

ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login. This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-4r4r-4jp4-wwf9 CRITICAL

FUXA has JWT Authentication Bypass via HTTP Referer header spoofing

AFFECTED PACKAGES:

NPM / @frangoteam/fuxa

<= 1.2.8

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Calibre Web 0.6.24 & Autocaliweb 0.7.0 - ReDoS

AFFECTED PACKAGES:

Unknown / Unknown

2 versions affected

ALIASES:

GHSA-2g7m-ph9x-7q7m, PYSEC-2026-1228

> HISTORIQUE DES MODIFICATIONS

Première apparition

24/07/2025 20:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:06

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui