gelbphoenix/autocaliweb

gelbphoenix/autocaliweb

Releases59

Frequency3 days 18 hours

Last Release 6 months ago

Stars233

(MOVED TO CODEBERG) :books: Web managing platform for eBooks, eComics and PDFs

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-55165 ↗	Aug 12, 2025Tuesday, 12 August 2025, 21:15	8.2 HIGH	—
Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This occurs because the to_dict() method, used to serialize configuration for the debug pack, doesn't adequately filter out sensitive fields such as API tokens. Users, unaware of the full contents, might share these debug packs, inadvertently leaking their private API keys. This issue has been patched in version 0.8.3.
CVE-2025-7404 ↗	Jul 24, 2025Thursday, 24 July 2025, 21:15	9.8 CRITICAL	—
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.
CVE-2025-6998 ↗	Jul 24, 2025Thursday, 24 July 2025, 20:15	—	—
ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login. This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.