CVE-2026-38469

Deferred Deferred - Pending Action

Stored XSS in GazellePosterWall Custom Bonus Title Feature

Publication date: 2026-08-25

Last updated on: 2026-08-31

Assigner: MITRE

Description

A Stored XSS vulnerability in the custom bonus title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=staff_tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-31

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-38469

EUVD

EUVD-2026-66170

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in GazellePW (GazellePosterWall) software. It allows authenticated users to inject malicious JavaScript code via the title parameter in /bonus.php and /user.php?action=staff_tool pages. The injected script is stored on the server and executed when other users view the affected pages.

Detection Guidance

To detect this Stored XSS vulnerability in GazellePW, inspect HTTP requests and responses to /bonus.php and /user.php?action=staff_tool for the title parameter. Look for JavaScript payloads in stored values. Manually check user-submitted titles in the bonus title feature for suspicious scripts.

Impact Analysis

An attacker with authenticated access could steal user session cookies, redirect users to malicious sites, or perform actions on behalf of users. This could lead to account takeover, data theft, or unauthorized actions within the application.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized access to user data or session hijacking. For HIPAA, it may risk exposing protected health information if user accounts with such data are compromised. Compliance depends on the specific data processed by the application.

Mitigation Strategies

Update GazellePW to the latest version that patches the stored XSS vulnerability in the custom bonus title feature. If no patch is available, disable the custom bonus title feature in /bonus.php and /user.php until a fix is applied.

Hi! I’m here to help you understand CVE-2026-38469. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70