CVE-2025-65858

LOW

Calibre-Web 0.6.25 - Stored Cross-Site Scripting via Username Field

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-65858. PoCs published by KhanhDuy155.

AI-analyzed exploit summary This repository contains a detailed technical analysis of CVE-2025-65858, a stored XSS vulnerability in Calibre-Web. It includes root cause analysis, affected endpoints, steps to reproduce, and proof-of-concept payloads.

Description

A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed.

Exploits (1)

nomisec WRITEUP
by KhanhDuy155 · poc
https://github.com/KhanhDuy155/calibre-web-CVE-2025-65858

This repository contains a detailed technical analysis of CVE-2025-65858, a stored XSS vulnerability in Calibre-Web. It includes root cause analysis, affected endpoints, steps to reproduce, and proof-of-concept payloads.

Classification
Writeup 100%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Calibre-Web v0.6.25
Auth required
Prerequisites: Admin access to Calibre-Web · Ability to create a new user
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 3.5
EPSS 0.0003
EPSS Percentile 9.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
janeczku/calibre-web 0.6.25
pypi/calibreweb 0PyPI
Published Dec 02, 2025
Tracked Since Feb 18, 2026