CVE-2019-7410

There is stored cross site scripting (XSS) in Galileo CMS v0.042. Remote authenticated users could inject arbitrary web script or HTML via $page_title in /lib/Galileo/files/templates/page/show.html.ep (aka the PAGE TITLE Field).

• CWE-79

• https://github.com/jberger/Galileo/pull/55/filesThird Party Advisory
• https://metacpan.org/changes/distribution/GalileoThird Party Advisory
• https://metamorfosec.com/Files/Advisories/METS-2020-002-A_Stored_XSS_Vulnerability_in_Galileo_CMS_v0.042.txtThird Party Advisory
• https://metamorfosec.com/Files/Commits/METC-2020-002-Escape_banner_in_Galileo_CMS_v0.042.txtPatch, Third Party Advisory
• https://github.com/jberger/Galileo/pull/55/filesThird Party Advisory
• https://metacpan.org/changes/distribution/GalileoThird Party Advisory
• https://metamorfosec.com/Files/Advisories/METS-2020-002-A_Stored_XSS_Vulnerability_in_Galileo_CMS_v0.042.txtThird Party Advisory
• https://metamorfosec.com/Files/Commits/METC-2020-002-Escape_banner_in_Galileo_CMS_v0.042.txtPatch, Third Party Advisory

Published

Aug 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-7400Rukovoditel before 2.4.1 allows XSS.6.1
• CVE-2019-7401NGINX Unit before 1.7.1 might allow an attacker to cause a h…
• CVE-2019-7402An issue was discovered in PHPMyWind 5.5. The GetQQ function…
• CVE-2019-7403An issue was discovered in PHPMyWind 5.5. It allows remote a…
• CVE-2019-7404An issue was discovered on LG GAMP-7100, GAPM-7200, and GAPM…
• CVE-2019-7409Multiple cross-site scripting (XSS) vulnerabilities in Profi…
• CVE-2019-7411Multiple stored cross-site scripting (XSS) in the MyThemeSho…
• CVE-2019-7412The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mish…
• CVE-2019-7413In the Parallax Scroll (aka adamrob-parallax-scroll) plugin …
• CVE-2019-7416XSS and/or a Client Side URL Redirect exists in OpenText Doc…
• CVE-2019-7417XSS exists in Ericsson Active Library Explorer (ALEX) 14.3 i…
• CVE-2019-7418XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 …