CVE-2026-38473

CVE-2026-38473 is a Stored XSS vulnerability in GazellePW (GazellePosterWall), a PHP-based application, specifically in the subtitle deletion flow at commit 86c4bedf. A remote authenticated user can inject arbitrary JavaScript by uploading a subtitle with a crafted filename. The malicious payload...