CVE-2024-44793

MediumCVSS 6.1

Published: 26/08/2024(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

An XSS vulnerability in the /managers/multiple_freeleech.php component of Gazelle (commit 63b3370) allows attackers to inject malicious scripts or HTML via the torrents parameter.

Risk Assessment

Attackers can execute arbitrary scripts in the victim's browser, potentially leading to session theft, account takeover, or data leakage.

Recommendation

Update Gazelle to the latest patched version and implement input validation and encoding for the torrents parameter.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in the component /managers/multiple_freeleech.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the torrents parameter.