CVE-2026-38472

Deferred Deferred - Pending Action

Stored XSS in GazellePW Forum Reward Comments

Publication date: 2026-08-25

Last updated on: 2026-08-31

Assigner: MITRE

Description

A Stored XSS vulnerability in forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arbitrary JavaScript via the c parameter in /forums.php?action=ajax_get_jf which is later rendered in the data-tooltip attribute in /forums.php?action=viewthread and interpreted as HTML by the Tooltipster configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-31

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-38472

EUVD

EUVD-2026-66169

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in GazellePW (GazellePosterWall). It allows attackers to inject malicious JavaScript code via the 'c' parameter in a specific URL. The injected script is later rendered in a tooltip on the forum page, where it can be executed by the browser.

Detection Guidance

To detect this Stored XSS vulnerability, inspect HTTP requests and responses to /forums.php?action=ajax_get_jf for the c parameter containing JavaScript code. Check if the injected payload appears in the data-tooltip attribute in /forums.php?action=viewthread responses.

Impact Analysis

An attacker could exploit this to run arbitrary JavaScript in your browser when viewing forum threads. This could lead to session hijacking, stealing cookies, or performing actions on your behalf without your knowledge.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling unauthorized script execution that may lead to data exfiltration or manipulation. Stored XSS attacks can compromise user sessions, steal sensitive data, or alter displayed information, which violates confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Immediately update GazellePW to the latest commit after 86c4bedf727691b5a97af42a4864869d18446449. Implement input validation and output encoding for the c parameter to prevent JavaScript injection. Sanitize data rendered in data-tooltip attributes.

Hi! I’m here to help you understand CVE-2026-38472. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70