Several stored XSS
Priority LOW 32CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscription page. The self subscription feature can be disabled as a workaround (this is the default state). Malicious javascript code can be executed (not stored) on login and retrieve password pages. This issue is patched in version 0.9.5.
Why it matters now
EPSS 0.00886 59th percentileScored 2026-11-07
Fix Fixed galette (galette): 0.9.5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
- Fix · CNA galette (galette) Fixed in 0.9.5
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21319
References
Patch 3
More Galette vulnerabilities
- TI-2024-16278 Galette public pages accessibility restriction CVSS 3.1HIGH 7.5
- TI-2025-35895 Galette has groups managers access control bypass on Members CVSS 4.0LOW 2.1
- TI-2021-18094 SQL Injection in Galette CVSS 3.1HIGH 8.8
- TI-2021-18092 Missing CSRF checks in Galette CVSS 3.1HIGH 8.8
- TI-2021-18093 Stored Cross-site Scripting in Galette CVSS 3.1HIGH 8.1
- TI-2025-31034 Galette is vulnerable to XSS through Document Type CVSS 4.0MEDIUM 5.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences