CVE-2021-21319mediumCWE-79

CVE-2021-21319: medium-severity vulnerability in galette

Several stored XSS

Published · Updated

Follow this CVE+ Monitor galette

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 0.9%
Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscription page. The self subscription feature can be disabled as a workaround (this is the default state). Malicious javascript code can be executed (not stored) on login and retrieve password pages. This issue is patched in version 0.9.5.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Affected products
galette · galette
Related CVEs — galette

In the same product, most dangerous first.

CVE-2021-41262HIGHSQL Injection in GaletteEPSS 1.1%CVE-2024-24761HIGHGalette public pages accessibility restrictionEPSS 0.6%CVE-2021-41261HIGHStored Cross-site Scripting in GaletteEPSS 0.6%CVE-2021-41260HIGHMissing CSRF checks in GaletteEPSS 0.4%CVE-2025-58052LOWGalette has groups managers access control bypass on MembersEPSS 0.3%CVE-2025-58053MEDIUMGalette has a privilege escalation vulnerabilityEPSS 0.3%