CVE-2021-25964 — Stored Cross-Site Scripting (XSS) in Calibre-web via Description Field in Metadata
In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”. An attacker that has access to edit the metadata information, can inject JavaScript …
Published: 2021-10-04 · CVSS: 5.4 · CVSS 3.1
In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”. An attacker that has access to edit the metadata information, can inject JavaScript payload in the description field. When a victim tries to open the file, XSS will be triggered.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7