CVE-2022-30765: 
Python vulnerability analysis and mitigation

Calibre-Web before version 0.6.18 contained a SQL injection vulnerability in the user table functionality. The vulnerability was identified and tracked as CVE-2022-30765, and was discovered by Iman Sharafaldin from Forward Security. The issue was officially fixed in Calibre-Web version 0.6.18, which was released to address this and other security concerns (Security Policy, Release Notes).

The vulnerability allowed for potential SQL injection attacks specifically targeting the user table functionality in Calibre-Web. This security flaw could potentially allow an attacker to manipulate SQL queries through user input, potentially compromising the database security (Security Policy).

The SQL injection vulnerability could potentially allow attackers to execute unauthorized SQL commands on the database, potentially leading to unauthorized access to user data, manipulation of database contents, or other malicious activities affecting the user table (Security Policy).

The vulnerability was patched in Calibre-Web version 0.6.18. Users are strongly advised to upgrade to this version or later to receive the security fix. The fix prevents possible SQL injection in the user table, as implemented in the security update (Release Notes).