CVE-2026-38465 in GazellePW信息

摘要

由 VulDB • 2026-08-26

GazellePW (GazellePosterWall) 中 donor avatar mouse-over text feature（捐赠者头像悬停文本功能）存在一个 Stored XSS（存储型跨站脚本攻击）漏洞，该问题出现在 commit 86c4bedf727691b5a97af42a4864869d18446449。远程经过身份验证的用户可通过 avatar_mouse_over_text 参数注入任意 JavaScript 代码，这些代码会被存储并在头像 tooltip（工具提示）中后续渲染执行。

If you want to get best quality of vulnerability data, you may have to visit VulDB.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

负责

MITRE

预定

2026-04-06

披露

2026-08-26

管理

已接受

条目

VDB-395364

CPE

准备好

CWE

CWE-79 (已确认)

CVSS

3.5 (VulDB)

EPSS

0.00000

KEV

否

活动

非常低

来源

MITRE	https://www.cve.org/CVERecord?id=CVE-2026-38465
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-38465
CVE Details	https://www.cvedetails.com/cve/CVE-2026-38465/

◂ 上一步一览下一步 ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!