Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-9s7t-8b7j-1beu

Summary Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database.

Aliases

alias	CVE-2024-7009

Fixed_packages

url pkg:deb/debian/calibre@5.12.0%2Bdfsg-1%2Bdeb11u2?distro=trixie

purl pkg:deb/debian/calibre@5.12.0%2Bdfsg-1%2Bdeb11u2?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-18qm-c6mu-8fak

vulnerability	VCID-2mwz-y7fg-qfa4

vulnerability	VCID-6zgf-rtue-43gp

vulnerability	VCID-7x16-ezgq-zqak

vulnerability	VCID-828z-mzdy-j3a1

vulnerability	VCID-wjqk-8cbn-yqeg

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/calibre@5.12.0%252Bdfsg-1%252Bdeb11u2%3Fdistro=trixie

url pkg:deb/debian/calibre@5.12.0%2Bdfsg-1%2Bdeb11u2

purl pkg:deb/debian/calibre@5.12.0%2Bdfsg-1%2Bdeb11u2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-18qm-c6mu-8fak

vulnerability	VCID-2ja9-9ec5-3qh3

vulnerability	VCID-2mwz-y7fg-qfa4

vulnerability	VCID-58gd-e3ep-afg5

vulnerability	VCID-6zgf-rtue-43gp

vulnerability	VCID-7atw-58g3-ybhx

vulnerability	VCID-7x16-ezgq-zqak

vulnerability	VCID-7zj9-6sqa-abax

vulnerability	VCID-828z-mzdy-j3a1

vulnerability	VCID-a3ch-c63a-vbat

vulnerability	VCID-hsqf-ha2c-qbh2

vulnerability	VCID-thmt-h8v1-fkck

vulnerability	VCID-wjqk-8cbn-yqeg

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/calibre@5.12.0%252Bdfsg-1%252Bdeb11u2

url	pkg:deb/debian/calibre@6.13.0%2Brepack-2%2Bdeb12u4?distro=trixie
purl	pkg:deb/debian/calibre@6.13.0%2Brepack-2%2Bdeb12u4?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/calibre@6.13.0%252Brepack-2%252Bdeb12u4%3Fdistro=trixie

url pkg:deb/debian/calibre@6.13.0%2Brepack-2%2Bdeb12u6?distro=trixie

purl pkg:deb/debian/calibre@6.13.0%2Brepack-2%2Bdeb12u6?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-18qm-c6mu-8fak

vulnerability	VCID-6zgf-rtue-43gp

vulnerability	VCID-wjqk-8cbn-yqeg

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/calibre@6.13.0%252Brepack-2%252Bdeb12u6%3Fdistro=trixie

url	pkg:deb/debian/calibre@7.16.0%2Bds-1?distro=trixie
purl	pkg:deb/debian/calibre@7.16.0%2Bds-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/calibre@7.16.0%252Bds-1%3Fdistro=trixie

url pkg:deb/debian/calibre@8.5.0%2Bds-1%2Bdeb13u2?distro=trixie

purl pkg:deb/debian/calibre@8.5.0%2Bds-1%2Bdeb13u2?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-18qm-c6mu-8fak

vulnerability	VCID-6zgf-rtue-43gp

vulnerability	VCID-wjqk-8cbn-yqeg

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/calibre@8.5.0%252Bds-1%252Bdeb13u2%3Fdistro=trixie

url	pkg:deb/debian/calibre@9.9.0%2Bds%2B~0.10.6-1?distro=trixie
purl	pkg:deb/debian/calibre@9.9.0%2Bds%2B~0.10.6-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/calibre@9.9.0%252Bds%252B~0.10.6-1%3Fdistro=trixie

url	pkg:ebuild/app-text/calibre@7.16.0
purl	pkg:ebuild/app-text/calibre@7.16.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:ebuild/app-text/calibre@7.16.0

Affected_packages

url pkg:deb/debian/calibre@0.7.7%2Bdfsg-1squeeze1

purl pkg:deb/debian/calibre@0.7.7%2Bdfsg-1squeeze1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2ja9-9ec5-3qh3

vulnerability	VCID-2stq-5xq8-xbfr

vulnerability	VCID-58gd-e3ep-afg5

vulnerability	VCID-7atw-58g3-ybhx

vulnerability	VCID-7zj9-6sqa-abax

vulnerability	VCID-9s7t-8b7j-1beu

vulnerability	VCID-a3ch-c63a-vbat

vulnerability	VCID-atgc-dumh-e7f8

vulnerability	VCID-f8sf-7cug-dfbg

vulnerability	VCID-hsqf-ha2c-qbh2

vulnerability	VCID-nm5a-yrqt-xkd9

vulnerability	VCID-nuh6-wgnj-q3fp

vulnerability	VCID-r78m-ab4q-y7hc

vulnerability	VCID-thmt-h8v1-fkck

vulnerability	VCID-w1bf-4xdy-aqht

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/calibre@0.7.7%252Bdfsg-1squeeze1

url pkg:deb/debian/calibre@0.8.51%2Bdfsg1-0.1

purl pkg:deb/debian/calibre@0.8.51%2Bdfsg1-0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2ja9-9ec5-3qh3

vulnerability	VCID-2stq-5xq8-xbfr

vulnerability	VCID-58gd-e3ep-afg5

vulnerability	VCID-7atw-58g3-ybhx

vulnerability	VCID-7zj9-6sqa-abax

vulnerability	VCID-9s7t-8b7j-1beu

vulnerability	VCID-a3ch-c63a-vbat

vulnerability	VCID-atgc-dumh-e7f8

vulnerability	VCID-f8sf-7cug-dfbg

vulnerability	VCID-hsqf-ha2c-qbh2

vulnerability	VCID-nm5a-yrqt-xkd9

vulnerability	VCID-nuh6-wgnj-q3fp

vulnerability	VCID-r78m-ab4q-y7hc

vulnerability	VCID-thmt-h8v1-fkck

vulnerability	VCID-w1bf-4xdy-aqht

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/calibre@0.8.51%252Bdfsg1-0.1

url pkg:deb/debian/calibre@1.22.0%2Bdfsg1-1~bpo70%2B2

purl pkg:deb/debian/calibre@1.22.0%2Bdfsg1-1~bpo70%2B2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2ja9-9ec5-3qh3

vulnerability	VCID-2stq-5xq8-xbfr

vulnerability	VCID-58gd-e3ep-afg5

vulnerability	VCID-7atw-58g3-ybhx

vulnerability	VCID-7zj9-6sqa-abax

vulnerability	VCID-9s7t-8b7j-1beu

vulnerability	VCID-a3ch-c63a-vbat

vulnerability	VCID-atgc-dumh-e7f8

vulnerability	VCID-hsqf-ha2c-qbh2

vulnerability	VCID-nuh6-wgnj-q3fp

vulnerability	VCID-thmt-h8v1-fkck

vulnerability	VCID-w1bf-4xdy-aqht

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/calibre@1.22.0%252Bdfsg1-1~bpo70%252B2

url pkg:deb/debian/calibre@2.5.0%2Bdfsg-1

purl pkg:deb/debian/calibre@2.5.0%2Bdfsg-1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2ja9-9ec5-3qh3

vulnerability	VCID-2stq-5xq8-xbfr

vulnerability	VCID-58gd-e3ep-afg5

vulnerability	VCID-7atw-58g3-ybhx

vulnerability	VCID-7zj9-6sqa-abax

vulnerability	VCID-9s7t-8b7j-1beu

vulnerability	VCID-a3ch-c63a-vbat

vulnerability	VCID-atgc-dumh-e7f8

vulnerability	VCID-hsqf-ha2c-qbh2

vulnerability	VCID-nuh6-wgnj-q3fp

vulnerability	VCID-thmt-h8v1-fkck

vulnerability	VCID-w1bf-4xdy-aqht

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/calibre@2.5.0%252Bdfsg-1

url pkg:deb/debian/calibre@2.75.1%2Bdfsg-1~bpo8%2B1

purl pkg:deb/debian/calibre@2.75.1%2Bdfsg-1~bpo8%2B1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2ja9-9ec5-3qh3

vulnerability	VCID-2stq-5xq8-xbfr

vulnerability	VCID-58gd-e3ep-afg5

vulnerability	VCID-7atw-58g3-ybhx

vulnerability	VCID-7zj9-6sqa-abax

vulnerability	VCID-9s7t-8b7j-1beu

vulnerability	VCID-a3ch-c63a-vbat

vulnerability	VCID-atgc-dumh-e7f8

vulnerability	VCID-hsqf-ha2c-qbh2

vulnerability	VCID-thmt-h8v1-fkck

vulnerability	VCID-w1bf-4xdy-aqht

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/calibre@2.75.1%252Bdfsg-1~bpo8%252B1

url pkg:deb/debian/calibre@2.75.1%2Bdfsg-1

purl pkg:deb/debian/calibre@2.75.1%2Bdfsg-1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2ja9-9ec5-3qh3

vulnerability	VCID-2stq-5xq8-xbfr

vulnerability	VCID-58gd-e3ep-afg5

vulnerability	VCID-7atw-58g3-ybhx

vulnerability	VCID-7zj9-6sqa-abax

vulnerability	VCID-9s7t-8b7j-1beu

vulnerability	VCID-a3ch-c63a-vbat

vulnerability	VCID-atgc-dumh-e7f8

vulnerability	VCID-hsqf-ha2c-qbh2

vulnerability	VCID-thmt-h8v1-fkck

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/calibre@2.75.1%252Bdfsg-1

url pkg:deb/debian/calibre@3.39.1%2Bdfsg-3

purl pkg:deb/debian/calibre@3.39.1%2Bdfsg-3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2ja9-9ec5-3qh3

vulnerability	VCID-2stq-5xq8-xbfr

vulnerability	VCID-58gd-e3ep-afg5

vulnerability	VCID-7atw-58g3-ybhx

vulnerability	VCID-7zj9-6sqa-abax

vulnerability	VCID-9s7t-8b7j-1beu

vulnerability	VCID-a3ch-c63a-vbat

vulnerability	VCID-hsqf-ha2c-qbh2

vulnerability	VCID-thmt-h8v1-fkck

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/calibre@3.39.1%252Bdfsg-3

References

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2024-7009

reference_id

reference_type

scores

value	0.08423
scoring_system	epss
scoring_elements	0.92548
published_at	2026-06-14T12:55:00Z

value	0.08423
scoring_system	epss
scoring_elements	0.92519
published_at	2026-06-11T12:55:00Z

value	0.08423
scoring_system	epss
scoring_elements	0.92544
published_at	2026-06-12T12:55:00Z

value	0.08423
scoring_system	epss
scoring_elements	0.92547
published_at	2026-06-13T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2024-7009

reference_url	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7009
reference_id
reference_type
scores
url	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7009

reference_url

https://starlabs.sg/advisories/24/24-7009/

reference_id

24-7009

reference_type

scores

value	4.2
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-06T13:15:35Z/

url

https://starlabs.sg/advisories/24/24-7009/

reference_url

https://github.com/kovidgoyal/calibre/commit/d56574285e8859d3d715eb7829784ee74337b7d7

reference_id

d56574285e8859d3d715eb7829784ee74337b7d7

reference_type

scores

value	4.2
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-06T13:15:35Z/

url

https://github.com/kovidgoyal/calibre/commit/d56574285e8859d3d715eb7829784ee74337b7d7

reference_url	https://security.gentoo.org/glsa/202409-04
reference_id	GLSA-202409-04
reference_type
scores
url	https://security.gentoo.org/glsa/202409-04

Weaknesses

cwe_id	89
name	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description	The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Exploits

Severity_range_score 4.2 - 4.2

Exploitability 0.5

Weighted_severity 3.8

Risk_score 1.9

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-9s7t-8b7j-1beu

Vulnerability Instance