Live › vulnerability › CVE-2022-30765
Go to dashboardCalibre-Web versions before 0.6.18 let an attacker inject SQL through a user table query. The attacker can read or change the application's database contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:20 UTC, 0h before NVD. All times on this page are UTC.
Teams running Calibre-Web from PyPI at a version before 0.6.18 are affected. The sources do not say which features or configurations are needed to reach the vulnerable query, so exposure beyond the version check is unknown.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| calibreweb | pypi | < 0.6.18 | 0.6.18 |
| janeczku calibre-web | vendor | = 0.6.18 | – |
pip show calibreweb and confirm the version is below 0.6.18pip freeze | grep -i calibrewebcalibreweb to 0.6.18 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Calibre-Web before 0.6.18 allows user table SQL Injection.
This page as .md · .json · in your agent: get_signal("CVE-2022-30765")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.