p PatchFirst

CVE-2024-39123

CVE-2024-39123

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the clean_string function. The vulnerability arises from the way the clean_string function handles HTML sanitization.

CVSS 5.4 · Medium · EPSS 23.1%

Published
Updated

Stack: python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • calibreweb PyPI

    Versions
    • 0.6.12
    • 0.6.13
    • 0.6.14
    • 0.6.15
    • 0.6.16
    • 0.6.17
    • 0.6.18
    • 0.6.19
    • 0.6.20
    • 0.6.21
    Affected ranges
    • ECOSYSTEM: ≥ 0.6.0, ≤ 0.6.21

    No fix published

Original sources

Check your server →