CVE-2021-25965: Janeczku Calibre-Web

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF). By luring an authenticated user to click on a link, an attacker can create a new user role with admin privileges and attacker-controlled credentials, allowing them to take over the application.

Affected products

• Janeczku Calibre-Web: from 0.6.0, up to and including 0.6.13

Published 2021-11-16. Last modified 2026-06-17.