CVE-2026-38465
Low risk· EPSS 21%Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW (GazellePosterWall) allows remote authenticated users to inject arbitrary JavaScript via the avatar_mouse_over_text parameter, which is stored and later rendered in avatar tooltip.
Risk Assessment
An attacker can execute malicious scripts in other users' browsers, potentially leading to session theft, account takeover, or spreading malicious content.
Recommendation
Update GazellePW to the latest patched version or apply proper input filtering and encoding for the avatar_mouse_over_text parameter.
Other vulnerabilities in GazellePW
See all- CVE-2026-38474Low risk· EPSS 21%
Broken access control vulnerability in the IP lock manager in GazellePW (GazellePosterWall) allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock.
- CVE-2026-38473Low risk· EPSS 21%
Stored XSS vulnerability in the subtitle deletion flow in GazellePW (GazellePosterWall) allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, which is stored during upload and later rendered in /subtitles.php?action=delete.
- CVE-2026-38472Low risk· EPSS 21%
Stored XSS vulnerability in forum reward comments in GazellePW (GazellePosterWall) allows remote attackers to inject arbitrary JavaScript via the c parameter in /forums.php?action=ajax_get_jf which is later rendered in the data-tooltip attribute in /forums.php?action=viewthread and interpreted as HTML by the Tooltipster configuration.
- CVE-2026-38470Low risk· EPSS 10%
Broken access control vulnerability in the API user endpoint in GazellePW (GazellePosterWall) allows unprivileged, authenticated users to enable or disable arbitrary user accounts via the req=disable or req=enable action using a normal user-created API token.
- CVE-2026-38469Low risk· EPSS 21%
Stored XSS vulnerability in the custom bonus title feature in GazellePW (GazellePosterWall) allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=staff_tool.
- CVE-2026-38468Low risk· EPSS 21%
SQL injection vulnerability in the country-code lookup endpoint in GazellePW (GazellePosterWall) allows remote authenticated users with users_view_ips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to tools.php?action=get_cc.
- CVE-2026-38467Low risk· EPSS 20%
SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) allows remote authenticated users with users_mod privileges to execute arbitrary SQL commands via the tagid or type parameter in a crafted POST request to tools.php?action=manage_tags.
- CVE-2026-38466Low risk· EPSS 22%
A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW (GazellePosterWall) allows remote authenticated users to inject arbitrary JavaScript via the remaster_custom_title parameter, which is stored during torrent upload or edit and later rendered in torrent title output.
Original NVD description (English source)
A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the avatar_mouse_over_text parameter, which is stored and later rendered in avatar tooltip.