repository icon
janeczku / calibre-web Project repository

:books: Web app for browsing, reading and downloading eBooks stored in a Calibre database

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN44 DAYS

FIX

WITHIN124 DAYS

Cross-site scripting (XSS) stored in href bypasses filter using data wrapper
mrempy
Medium
Insufficient Session Expiration
mrempy
pending
SMTP server credentials are returned
mrempy
Medium
Improper Access Control
ch1nhpd
informative
Critical
Cross-site Scripting (XSS) - Stored
mrempy
Low
DOS at login function
ch1nhpd
pending
Improper Error Handling at Rating function
baobaovt
Medium
Server-Side Request Forgery (SSRF)
dungtuanha
informative
Critical
Weak Password Requirements
domiee13
High
•$25•CVE-2023-2106
Improper Restriction of Excessive Authentication Attempts in login feature
domiee13
High
•$25•CVE-2022-2525
Open redirection via host header injection
nikunjsapara
not applicable
Server-Side Request Forgery (SSRF)
michaellrowley
Critical
•$45•CVE-2022-0990
Server-Side Request Forgery (SSRF)
416e6e61
Critical
•$45•CVE-2022-0939
Server-Side Request Forgery (SSRF)
416e6e61
Critical
•$45•CVE-2022-0767
Server-Side Request Forgery (SSRF)
r0hansh
Medium
•$40•CVE-2022-0766
Improper Authorization
nhiephon
Medium
•$42.5•CVE-2022-0406
Improper Access Control
nhiephon
Medium
•$26•CVE-2022-0405
Improper Access Control
nhiephon
Medium
•CVE-2022-0273
Cross-site Scripting (XSS) - Reflected
alicaz
High
•$28.5•CVE-2022-0352
Business Logic Errors
alicaz
High
•$85•CVE-2021-4171
Cross-site Scripting (XSS) - Stored
scara31
High
•$42.5•CVE-2021-4170
Server-Side Request Forgery (SSRF)
scara31
Medium
•$68•CVE-2022-0339
Cross-Site Request Forgery (CSRF)
scara31
High
•$26•CVE-2021-4164
Improperly Controlled Modification of Dynamically-Determined Object Attributes
acciobugs
Medium
Improper Access Control
acciobugs
Medium
•$80•CVE-2021-3987
Cross-site Scripting (XSS) - DOM
acciobugs
Medium
•$48•CVE-2021-3988
Generation of Error Message Containing Sensitive Information
acciobugs
Medium
•$96•CVE-2021-3986
Cross-Site Request Forgery (CSRF)
ranjit-git
High
•$50
Cross-Site Request Forgery (CSRF)
mik317
Medium
•$80
Cross-site Scripting (XSS) - Stored
ranjit-git
High
•$40
Improperly Controlled Modification of Dynamically-Determined Object Attributes
acciobugs
Medium
•$40
Cross-Site Request Forgery (CSRF)
acciobugs
High
•$40
Exposure of Private Personal Information to an Unauthorized Actor
acciobugs
Medium
•$40
Improper Access Control
acciobugs
High
•$40
Insufficient Session Expiration
acciobugs
Medium
•$40