CVE-2026-38469

A Stored XSS vulnerability in the custom bonus title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=stafftool...

CVE-2026-80050 ContiNew Admin through 4.1.0 Missing Authorization and File-Type Allowlist on Multipart Upload Endpoints

ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, send file parts, and complete uploads to leave arbitrary...

CVE-2026-79774 Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy

Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\Twig\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent...

CVE-2026-79666 Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints

Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data...

CVE-2026-79666

Ech0 versions before 4.4.3 fail to enforce administrator authorization on dashboard log endpoints. Any authenticated user can query GET /api/system/logs and subscribe to SSE and WebSocket log streams, retrieving sensitive operational data including file paths, stack traces, and internal URLs . Th...

SUSE CVE-2026-23931

The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality...

PT-2026-81854

Name of the Vulnerable Software and Affected Versions GazellePW GazellePosterWall versions prior to commit 86c4bedf727691b5a97af42a4864869d18446449 Description A SQL injection issue exists in the tags manager. Remote authenticated users with users mod privileges can execute arbitrary SQL commands...

PT-2026-81872

A Stored XSS vulnerability in the subtitle deletion flow in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, which is stored during upload and later rendered in...

CVE-2026-38465

A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the avatarmouseovertext parameter, which is stored and later rendered in avata...

CVE-2026-38469: Improper Neutralization of Input During Web Page Generation

A Stored XSS vulnerability in the custom bonus title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=stafftool...

CVE-2026-38474: Improper Access Control

GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock...

CVE-2026-38468

A SQL injection vulnerability in the country-code lookup endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with usersviewips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to...

PT-2026-81855

A SQL injection vulnerability in the country-code lookup endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with users view ips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to...

CVE-2026-38468

A SQL injection vulnerability exists in the country-code lookup endpoint of GazellePW (GazellePosterWall) , specifically in commit 86c4bedf727691b5a97af42a4864869d18446449 . Remote authenticated users possessing users_view_ips privileges can execute arbitrary SQL commands by sending a crafted req...

CVE-2026-38465

A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the avatarmouseovertext parameter, which is stored and later rendered in avata...

CVE-2026-38469

A Stored XSS vulnerability in the custom bonus title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=stafftool...

PT-2026-81869

A Stored XSS vulnerability in the custom bonus title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=staff tool...

PT-2026-81873

Name of the Vulnerable Software and Affected Versions GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 Description Broken access control in the IP lock manager allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts. This is...

CVE-2026-38465: Improper Neutralization of Input During Web Page Generation

A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the avatarmouseovertext parameter, which is stored and later rendered in avata...

CVE-2026-38474

The software GazellePW (GazellePosterWall) , specifically commit 86c4bedf727691b5a97af42a4864869d18446449 , contains a Broken access control vulnerability within the IP lock manager. This flaw allows remote authenticated users to perform unauthorized actions, such as adding, modifying, or deletin...