CVE-2025-48076CWE-79CWE-87cross-site-scripting

CVE-2025-48076

Medium · published November 5, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
7.1
In the wild
Unconfirmed
What it is

Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue is fixed in version 1.2.0.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00179 · 7.1th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-87 · Improper Neutralization of Alternate XSS Syntax
Published
2025-11-05T02:15Z
Affected products (2)
ProductVersionsFixed in
galette/galette< 1.2.01.2.0
galette/galetteall versions—
References (1)
https://github.com/galette/galette/security/advisories/GHSA-ccwq-mxx3-chvh · [email protected]
EPSS history
Timeline
  • 04 NOV 20:40Z
    Galette is vulnerable to Cross-site Scripting
    cvelistv5