Medium severity5.4NVD Advisory· Published Jul 19, 2024· Updated Jun 17, 2026
CVE-2024-39123
CVE-2024-39123
Description
In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the clean_string function. The vulnerability arises from the way the clean_string function handles HTML sanitization.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
calibrewebPyPI | >= 0.6.0, <= 0.6.21 | — |
Affected products
3cpe:2.3:a:janeczku:calibre-web:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:janeczku:calibre-web:*:*:*:*:*:*:*:*range: >=0.6.0,<=0.6.21
- (no CPE)
Patches
Vulnerability mechanics
References
3- github.com/pentesttoolscom/vulnerability-research/tree/master/CVE-2024-39123nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-j22r-3rf3-cv25ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-39123ghsaADVISORY
News mentions
0No linked articles in our index yet.