CVE-2026-38465 in GazellePWinfo

Summary

by MITRE • 08/25/2026

A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the avatar_mouse_over_text parameter, which is stored and later rendered in avatar tooltip.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsible

MITRE

Reservation

04/06/2026

Disclosure

08/25/2026

Moderation

accepted

CPE

ready

EPSS

0.00000

KEV

no

Activities

very low

Sources

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-38465
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-38465
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-38465/

◂ PreviousOverviewNext ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!