https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-10T00:19:35.664609+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2021-3988 CVE-2021-3988 — Cross-site Scripting (XSS) in janeczku/calibre-web 2026-10-10T00:19:35.852597+00:00

Affected: janeczku/calibre-web, janeczku calibre-web

A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization, allowing attackers to execute arbitrary JavaScript code. This can lead to various attacks, including stealing cookies. The issue is present in the code handling the `#btn-upload-cover` change event.

 https://vulnerability.circl.lu/vuln/ghsa-r735-9gc6-2hvq GHSA-r735-9gc6-2hvq — Cross-site Scripting (XSS) - DOM in janeczku/calibre-web 2026-10-10T00:19:35.852734+00:00

Affected: PyPI: calibreweb

A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization, allowing attackers to execute arbitrary JavaScript code. This can lead to various attacks, including stealing cookies. The issue is present in the code handling the `#btn-upload-cover` change event.