CVE-2024-44793
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
An XSS vulnerability in the /managers/multiple_freeleech.php component of Gazelle (commit 63b3370) allows attackers to inject malicious scripts or HTML via the torrents parameter.
Risk Assessment
Attackers can execute arbitrary scripts in the victim's browser, potentially leading to session theft, account takeover, or data leakage.
Recommendation
Update Gazelle to the latest patched version and implement input validation and encoding for the torrents parameter.
Other vulnerabilities in Gazelle
See all- CVE-2024-44797Medium
A cross-site scripting (XSS) vulnerability in the /managers/enable_requests.php component of Gazelle (commit 63b3370) allows attackers to inject arbitrary scripts or HTML via the view parameter. This can lead to arbitrary JavaScript execution in the victim's browser.
- CVE-2024-44795Medium
A cross-site scripting (XSS) vulnerability in the /login/disabled.php component of Gazelle (commit 63b3370) allows attackers to inject arbitrary web scripts or HTML via the username parameter.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability in the component /managers/multiple_freeleech.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the torrents parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS