CVE-2026-38473

The software GazellePW (GazellePosterWall) , specifically commit 86c4bedf727691b5a97af42a4864869d18446449, contains a Stored XSS vulnerability within its subtitle deletion flow. An authenticated remote user can inject arbitrary JavaScript by providing a crafted subtitle filename . This malicious ...

CVE-2026-38473: Improper Neutralization of Input During Web Page Generation

A Stored XSS vulnerability in the subtitle deletion flow in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, which is stored during upload and later rendered in...

CVE-2026-38473

A Stored XSS vulnerability in the subtitle deletion flow in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, which is stored during upload and later rendered in...

PT-2026-81872

A Stored XSS vulnerability in the subtitle deletion flow in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, which is stored during upload and later rendered in...