CVE-2026-38467
Deferred Deferred - Pending Action

SQL Injection in GazellePosterWall Tags Manager

Publication date: 2026-08-25

Last updated on: 2026-08-31

Assigner: MITRE

Description
A SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with users_mod privileges to execute arbitrary SQL commands via the tagid or type parameter in a crafted POST request to tools.php?action=manage_tags.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-31
Generated
2026-09-15
AI Q&A
2026-08-26
EPSS Evaluated
2026-09-13
NVD
CVE-2026-38467
EUVD
EUVD-2026-66174

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gazelleposterwall gazellepw *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in GazellePW (GazellePosterWall). It allows remote authenticated users with users_mod privileges to execute arbitrary SQL commands by manipulating the tagid or type parameter in a POST request to tools.php?action=manage_tags.

Detection Guidance

To detect this SQL injection vulnerability in GazellePW, monitor HTTP POST requests to tools.php with action=manage_tags. Look for unusual tagid or type parameter values containing SQL syntax like single quotes, semicolons, or SQL keywords (e.g., UNION, SELECT). Check server logs for error messages indicating SQL syntax issues.

Impact Analysis

An attacker could exploit this to read, modify, or delete sensitive data in the database, bypass authentication, or execute administrative operations. This could lead to data breaches, unauthorized access, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update GazellePW to the latest version or apply a patch addressing this issue. Restrict access to the tools.php endpoint to only trusted users. Implement input validation for tagid and type parameters to block SQL metacharacters. Consider disabling the tags manager feature temporarily if no patch is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-38467. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart