CVE-2024-39123: Janeczku Calibre-Web

Medium severity, CVSS 5.4. EPSS: 23.1% chance of exploitation in the next 30 days.

In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the clean_string function. The vulnerability arises from the way the clean_string function handles HTML sanitization.

Affected products

• Janeczku Calibre-Web: from 0.6.0, up to and including 0.6.21

Published 2024-07-19. Last modified 2026-06-17.