CVE-2026-38473

CVE-2026-38473 is a Stored XSS vulnerability in GazellePW (GazellePosterWall), a PHP-based application, specifically in the subtitle deletion flow at commit 86c4bedf. A remote authenticated user can inject arbitrary JavaScript by uploading a subtitle with a crafted filename. The malicious payload...

CVE-2026-38466

CVE-2026-38466 is a Stored XSS vulnerability in GazellePW (GazellePosterWall) , specifically in the torrent remaster custom title feature. The remaster_custom_title parameter is stored unsanitized during torrent upload or edit and later rendered in the torrent title output, allowing remote authen...

CVE-2026-38472

GazellePW (GazellePosterWall) contains a Stored XSS vulnerability in its forum reward comments feature, identified at commit 86c4bedf727691b5a97af42a4864869d18446449 . Remote attackers can inject arbitrary JavaScript through the c parameter in /forums.php?action=ajax_get_jf. The injected payload ...

CVE-2026-38469

A Stored XSS vulnerability in the custom bonus title feature of GazellePW (GazellePosterWall) (commit 86c4bedf) allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=staff_tool. The vulnerable sinks are located in users.class.p...

CVE-2026-38468

This is a SQL injection vulnerability in GazellePW (GazellePosterWall) , a private music tracker application, specifically in the country-code lookup endpoint (tools.php?action=get_cc). The ip parameter is not properly sanitized, allowing remote authenticated users holding the users_view_ips priv...

CVE-2026-38470

CVE-2026-38470 is a broken access control vulnerability in the API user endpoint of GazellePW (GazellePosterWall) , specifically at commit 86c4bedf727691b5a97af42a4864869d18446449. An unprivileged, authenticated user holding a standard user-created API token can enable or disable arbitrary user a...

CVE-2026-38465

GazellePW (GazellePosterWall), a PHP-based poster wall application, is affected by a Stored XSS in the donor avatar mouse-over text feature. The avatar_mouse_over_text parameter is stored and subsequently rendered in an avatar tooltip without sufficient output encoding, allowing remote authentica...

CVE-2026-38474

GazellePW (GazellePosterWall), a media management application, contains a Broken Access Control vulnerability in its IP lock manager . At commit 86c4bedf, the endpoint tools.php?action=iplock does not properly validate that the authenticated user owns the target account, allowing any remote authe...

CVE-2026-38467

CVE-2026-38467 is a SQL injection vulnerability in the tags manager of GazellePW (GazellePosterWall), specifically in commit 86c4bedf. Remote authenticated users holding users_mod privileges can execute arbitrary SQL commands by crafting a POST request to tools.php?action=manage_tags using the ta...