{"id":"CVE-2025-65858","aliases":["GHSA-pc5g-j9j7-p4q3","PYSEC-2026-1234"],"title":"Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation","summary":"Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation","severity":"low","vendor":"calibreweb","product":"calibreweb","ecosystem":"pip","affected":["calibreweb <= 0.6.25"],"published":"2025-12-02","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-pc5g-j9j7-p4q3","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65858"},{"url":"https://github.com/KhanhDuy155/calibre-web-CVE-2025-65858/blob/main/CVE-2025-65858.md"},{"url":"https://github.com/janeczku/calibre-web"}],"tags":["osv","pip","exploit-available"],"epss":0.00206,"epssPercentile":0.10916,"ingestedAt":"2026-07-08T18:25:51.743Z","exploits":{"github":1,"githubRepos":["https://github.com/KhanhDuy155/calibre-web-CVE-2025-65858"],"checkedAt":"2026-09-23T07:13:38.101Z"},"exploitAvailable":true,"slug":"CVE-2025-65858","body":"## Overview\n\nA Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed.\n\n## Affected packages\n\n- `calibreweb <= 0.6.25`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":26,"depthScoreParts":{"impact":13.8,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":4861,"id":"CVE-2025-65858","ts":1788887212213,"field":"exploit_available","old":"false","new":"true"},{"seq":3744,"id":"CVE-2025-65858","ts":1788886328832,"field":"exploit_available","old":"true","new":"false"},{"seq":2589,"id":"CVE-2025-65858","ts":1788883009893,"field":"exploit_available","old":"false","new":"true"},{"seq":1618,"id":"CVE-2025-65858","ts":1788882410204,"field":"exploit_available","old":"true","new":"false"},{"seq":729,"id":"CVE-2025-65858","ts":1788881847434,"field":"exploit_available","old":"false","new":"true"}]}