CVE-2021-21319— Several stored XSS
Quick assessment
Affected
galette galette
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Galette是开源的一个面向非营利组织的会员管理网络应用程序。 Galette 0.9.5 之前版本存在跨站脚本漏洞，攻击者可以存储恶意javascript代码并在自订阅页面上显示。
Possible ATT&CK Techniques 3 AI
T1059.007 · JavaScript T1190 · Exploit Public-Facing Application T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-21319
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Several stored XSS
Source: CVE Program / CVE List V5
Vulnerability Description
Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscription page. The self subscription feature can be disabled as a workaround (this is the default state). Malicious javascript code can be executed (not stored) on login and retrieve password pages. This issue is patched in version 0.9.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Galette 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Galette是开源的一个面向非营利组织的会员管理网络应用程序。 Galette 0.9.5 之前版本存在跨站脚本漏洞，攻击者可以存储恶意javascript代码并在自订阅页面上显示。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-21319
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-21319
请登录查看更多情报信息。
Patches & Fixes for CVE-2021-21319 (3)
Vendor Advisories for CVE-2021-21319 (1)
-
https://github.com/galette/galette/security/advisories/GHSA-vjc9-mj44-x59q x_refsource_CONFIRM
Other References for CVE-2021-21319 (1)
-
https://bugs.galette.eu/issues/1535 x_refsource_MISC
IV. Related Vulnerabilities
Same product: galette
-
CVE-2025-58053
Galette has a privilege escalation vulnerability -
CVE-2025-58052
Galette has groups managers access control bypass on Members -
CVE-2025-53922
Galette has access control bypass -
CVE-2025-48884
Galette is vulnerable to XSS through Document Type -
CVE-2025-48076
Galette is vulnerable to Cross-site Scripting
Same vendor: galette
-
CVE-2025-58053
Galette has a privilege escalation vulnerability -
CVE-2025-58052
Galette has groups managers access control bypass on Members -
CVE-2025-53922
Galette has access control bypass -
CVE-2025-48884
Galette is vulnerable to XSS through Document Type -
CVE-2025-48076
Galette is vulnerable to Cross-site Scripting
Same weakness: CWE-79
-
CVE-2026-81814
Flowintel Stored XSS in Calendar via Malicious Case Title -
CVE-2026-81753
Flowintel Stored XSS in Case Notes via Malicious Mermaid Dia -
CVE-2026-66155
Element maps-ng多点XSS漏洞 -
CVE-2026-78293
WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Script -
CVE-2026-78289
WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (X
V. Comments for CVE-2021-21319
No comments yet