https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T16:27:31.534576+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-262275 EUVD-2026-262275 2026-10-02T16:27:31.537230+00:00 EUVD-2026-262275 https://cve.radiocsirt.org/vuln/fkie_cve-2025-65858 fkie_cve-2025-65858 2026-10-02T16:27:31.537261+00:00

A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed.

 https://cve.radiocsirt.org/vuln/ghsa-pc5g-j9j7-p4q3 GHSA-pc5g-j9j7-p4q3 — Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation 2026-10-02T16:27:31.537299+00:00

Affected: PyPI: calibreweb

A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed.

 https://cve.radiocsirt.org/vuln/pysec-2026-1234 PYSEC-2026-1234 — Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation 2026-10-02T16:27:31.537324+00:00

Affected: PyPI: calibreweb

A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed.