CVE-2021-41261

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to stored cross site scripting attacks via the preferences footer. The preference footer can only be altered by a site admin. This issue has been resolved in the 0.9.6 release and all users are advised to upgrade. There are no known workarounds.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Dec 16, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-412628.8Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are CVE-2021-412638.8rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications usiCVE-2021-412649.8OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UUPSUpgradeable` may bCVE-2021-412658.8Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability iCVE-2021-412669.8Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versiCVE-2021-412676.5Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP comCVE-2021-412688.8Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP componCVE-2021-412699.8cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versCVE-2021-41279.8An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects ThuCVE-2021-412706.5Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and aCVE-2021-412715.3Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cacCVE-2021-412727.5Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations r