CVE-2026-38473

GazellePW (GazellePosterWall) is affected by a Stored XSS vulnerability in its subtitle deletion flow at commit 86c4bedf727691b5a97af42a4864869d18446449. A remote authenticated user can inject arbitrary JavaScript by crafting a subtitle filename during upload; the payload is stored and later rend...

CVE-2026-38473

A Stored XSS vulnerability in the subtitle deletion flow in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, which is stored during upload and later rendered in...