CVE-2021-21319
lowpriority · track · 22EPSS 0.009 · 59 %ileEUUSEPSS · scored 2026-10-27
Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscription page. The self subscription feature can be disabled as a workaround (this is the default state). Malicious javascript code can be executed (not stored) on login and retrieve password pages. This issue is patched in version 0.9.5.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.5–6.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (16)
External citations — patches, advisories, analysis.
- https://bugs.galette.eu/issues/1535cnnvd
- https://github.com/galette/galette/commit/514418da973ae5b84bf97f94bd288a41e8e3f0a6cnnvd
- https://github.com/galette/galette/commit/8f3bdd9f7d0708466e011253064a867ca2b271a5cnnvd
- https://github.com/galette/galette/commit/f54b2570615d38d0302e937079233e52c2d80995cnnvd
- https://github.com/galette/galette/security/advisories/GHSA-vjc9-mj44-x59qcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-21319cnnvd
- https://bugs.galette.eu/issues/1535enisa_euvd
- https://github.com/galette/galette/commit/514418da973ae5b84bf97f94bd288a41e8e3f0a6enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan