Gallery versions 1.3.3 and below suffer from a cross-site scripting vulnerability in its searching functionality.