by Kastro
Paper/Archive/CVE-2025-7404

CVE-2025-7404

Calibre Web Calibre Web — Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind C

EPSS 3%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 86.3.863 × 2017.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.

Affected

ProductAffectedFixed inSource
Calibre Web0.6.24–CNA
Autocaliweb0.7.0 – < 0.7.10.7.1CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fluid Attacks (CNA)5.9CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

exploitfluidattacks.com/advisories/kinorefgithub.com/janeczku/calibre-webrefgithub.com/gelbphoenix/autocaliweb