CVE-2025-48884CWE-79CWE-80cross-site-scripting

CVE-2025-48884

Medium · published November 5, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
8.6
In the wild
Unconfirmed
What it is

Galette is a membership management web application for non profit organizations. In versions 1.1.5.2 and below, Galette's Document Type is vulnerable to Cross-site Scripting. This issue is fixed in version 1.2.0.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00194 · 8.6th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2025-11-05T02:15Z
Affected products (2)
ProductVersionsFixed in
galette/galette< 1.2.01.2.0
galette/galetteall versions—
References (1)
https://github.com/galette/galette/security/advisories/GHSA-3rc3-rc5x-vmr4 · [email protected]
EPSS history
Timeline
  • 04 NOV 20:44Z
    Galette is vulnerable to XSS through Document Type
    cvelistv5