PT-2025-45044 · Galette · Galette

Published 2025-11-04 · Updated 2025-11-05 · CVE-2025-48076

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Galette versions 1.1.5.2 and below

Description Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group name and insert a Cross-site Scripting (XSS) payload. This issue is fixed in version 1.2.0.

Recommendations Update to version 1.2.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-87

CWE-79

Related Identifiers

CVE-2025-48076

GHSA-CCWQ-MXX3-CHVH

Affected Products

Galette

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48076.json · Exploit
• https://github.com/galette/galette/security/advisories/GHSA-ccwq-mxx3-chvh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48076 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48076 · Security Note
• https://t.me/CVEtracker/36552 · Telegram Post