CVE-2025-65858

13th percentile - higher than 13% of all known CVEs

A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed.

May lead to execution of malicious script in the browser of an administrator or other users, enabling session theft or actions on their behalf. It violates application integrity and confidentiality.

Update Calibre-Web to a version containing the fix or implement sanitization of the 'username' field and output encoding. Until updated, restrict user creation to trusted individuals.