Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2024-39123
5.4
MEDIUMCVSS v3
Published
July 19, 2024
Affected
1 project
Assigned by
MITRE
Severity scale
010
Description
In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the clean_string function. The vulnerability arises from the way the clean_string function handles HTML sanitization.
janeczku/calibre-web
GitHub:books: Web app for browsing, reading and downloading eBooks stored in a Calibre database
GitHub:books: Web app for browsing, reading and downloading eBooks stored in a Calibre database>= 0.6.0, <= 0.6.21NVD