CVE-2021-3986Medium· 4.3▾ SunlitGeneration of Error Message Containing Sensitive Information in janeczku/calibre-web
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
0.4% → 0.4%
A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they do not own. This vulnerability discloses private information and affects all versions prior to the fix.
calibreweb < 0.6.15Upgrade to a patched release:
calibreweb 0.6.15Connected by shared product, vendor, weakness, or advisory.
CVE-2021-4164High· 7.6calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
CVE-2021-4170Medium· 5.4calibre-web is vulnerable to Cross-site Scripting
CVE-2021-3988Medium· 6.1Cross-site Scripting (XSS) - DOM in janeczku/calibre-web
CVE-2025-7404MediumCalibre Web and Autocaliweb have OS Command Injection vulnerability
CVE-2025-65858LowCalibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation
CVE-2023-2106High· 7.3Weak Password Requirements in calibreweb