CVE-2025-7404

PoC —

CVSS 4.0

5.9 medium

EPSS

3%p85

Published

Jul 24, 2025 (Jul 24, 2025)

Modified

Jun 17, 2026

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.

Vendors: gelbphoenix janeczku
Products: autocaliweb, calibre-web
Weakness: CWE-78
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD CVE.org GitHub PoCs EPSS (2.8%)

In the news0 stories

No ingested article mentions this CVE yet.