CVE-2026-38467

CVE-2026-38467 is a SQL injection in the tags manager of GazellePW (GazellePosterWall), identified at commit 86c4bed. Remote authenticated users with users_mod privileges can execute arbitrary SQL commands via the tagid or type parameter in a crafted POST request to tools.php?action=manage_tags. ...