CVE-2026-38469

A Stored XSS vulnerability exists in the custom bonus title feature of GazellePW (GazellePosterWall) at commit 86c4bed. Remote authenticated users can inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=staff_tool, affecting low-level user accounts. The CVSS 3.1...

CVE-2026-38469

A Stored XSS vulnerability in the custom bonus title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=stafftool...