CVE-2026-38474

GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock...

CVE-2026-38469

A Stored XSS vulnerability in the custom bonus title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=stafftool...

CVE-2026-38473

A Stored XSS vulnerability in the subtitle deletion flow in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, which is stored during upload and later rendered in...

CVE-2026-38466

A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the remastercustomtitle parameter, which is stored during torrent upload or...

CVE-2026-38467

A SQL injection vulnerability in the tags manager in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with usersmod privileges to execute arbitrary SQL commands via the tagid or type parameter in a crafted POST request to...

CVE-2026-38468

A SQL injection vulnerability in the country-code lookup endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with usersviewips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to...

CVE-2026-38470

A Broken access control vulnerability in the API user endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows unprivileged, authenticated users to enable or disable arbitrary user accounts via the req=disable or req=enable action using a normal user-created...

CVE-2026-38465

A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the avatarmouseovertext parameter, which is stored and later rendered in avata...

CVE-2026-38468

A SQL injection vulnerability in the country-code lookup endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with usersviewips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to...

CVE-2026-38472

CVE-2026-38472 is a Stored XSS in GazellePW (GazellePosterWall), a forum application, specifically at commit 86c4bedf727691b5a97af42a4864869d18446449. Remote attackers can inject arbitrary JavaScript via the c parameter in /forums.php?action=ajax_get_jf (forum reward comments). The payload is lat...

CVE-2026-38469

A Stored XSS vulnerability exists in the custom bonus title feature of GazellePW (GazellePosterWall) at commit 86c4bed. Remote authenticated users can inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=staff_tool, affecting low-level user accounts. The CVSS 3.1...

CVE-2026-38466

CVE-2026-38466 is a Stored XSS in GazellePW (GazellePosterWall) at commit 86c4bedf. The remaster_custom_title parameter is stored during torrent upload or edit and later rendered unsanitized in torrent title output, allowing remote authenticated users to inject arbitrary JavaScript. The vulnerabi...

CVE-2026-38473

GazellePW (GazellePosterWall) is affected by a Stored XSS vulnerability in its subtitle deletion flow at commit 86c4bedf727691b5a97af42a4864869d18446449. A remote authenticated user can inject arbitrary JavaScript by crafting a subtitle filename during upload; the payload is stored and later rend...

CVE-2026-38465

A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the avatarmouseovertext parameter, which is stored and later rendered in avata...

CVE-2026-38470

A Broken access control vulnerability in the API user endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows unprivileged, authenticated users to enable or disable arbitrary user accounts via the req=disable or req=enable action using a normal user-created...

CVE-2026-38468

A SQL injection vulnerability exists in the country-code lookup endpoint (tools.php?action=get_cc ) of GazellePW (GazellePosterWall), as of commit 86c4bed. Remote authenticated users holding the users_view_ips privilege can execute arbitrary SQL commands by crafting a malicious value in the ip pa...

CVE-2026-38474

GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock...

CVE-2026-38470

A Broken Access Control vulnerability exists in the API user endpoint (app/API/User.php) of GazellePW (GazellePosterWall) at commit 86c4bedf727691b5a97af42a4864869d18446449. Unprivileged, authenticated users can enable or disable arbitrary user accounts by invoking the req=disable or req=enable a...

CVE-2026-38469

A Stored XSS vulnerability in the custom bonus title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=stafftool...

CVE-2026-38467

A SQL injection vulnerability in the tags manager in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with usersmod privileges to execute arbitrary SQL commands via the tagid or type parameter in a crafted POST request to...