CVE-2021-3988

A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization, allowing attackers to execute arbitrary JavaScript code. This can lead to various attacks, including stealing cookies. The issue is present in the code handling the `#btn-upload-cover` change event.

• CWE-79

• https://github.com/janeczku/calibre-web/commit/7ad419dc8c12180e842a82118f4866ac3d074bc5Patch
• https://huntr.com/bounties/fa4c8fd1-7846-4dad-9112-2c07461f0609Exploit

Published

Nov 15, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39874In all versions of GitLab CE/EE since version 11.0, the requ…4.3
• CVE-2021-39875In all versions of GitLab CE/EE since version 13.6, it is po…5.3
• CVE-2021-39876In all versions of GitLab CE/EE since version 11.3, the endp…4.3
• CVE-2021-39877A vulnerability was discovered in GitLab starting with versi…5.5
• CVE-2021-39878A stored Reflected Cross-Site Scripting vulnerability in the…5.4
• CVE-2021-39879Missing authentication in all versions of GitLab CE/EE since…3.5
• CVE-2021-39880A Denial Of Service vulnerability in the apollo_upload_serve…6.5
• CVE-2021-39881In all versions of GitLab CE/EE since version 7.7, the appli…3.5
• CVE-2021-39882In all versions of GitLab CE/EE, provided a user ID, anonymo…5.3
• CVE-2021-39883Improper authorization checks in all versions of GitLab EE s…4.3
• CVE-2021-39884In all versions of GitLab EE since version 8.13, an endpoint…4.3
• CVE-2021-39885A Stored XSS in merge request creation page in all versions …5.4