PatchSiren cyber security CVE debrief

CVE-2026-38465 Mosasauroidea CVE debrief

The CVE-2026-38465 vulnerability is a Stored XSS issue in GazellePW's donor avatar mouse-over text feature. This vulnerability allows remote authenticated users to inject arbitrary JavaScript via the avatar_mouse_over_text parameter. The CVE record was published on 2026-08-25T22:17:03.020Z. Users of GazellePW, especially those with administrative privileges, should be aware of this vulnerability and take necessary actions to mitigate it. The vulnerability has a medium severity with a CVSS score of 5.4. Affected product deployments should be verified, and owners assigned for follow-up. The CVE Program and NVD provide official records and details.

Vendor: Mosasauroidea
Product: GazellePW
CVSS: MEDIUM 5.4
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-08-25
Original CVE updated: 2026-08-31
Advisory published: 2026-08-25
Advisory updated: 2026-08-31

Who should care

Users of GazellePW, especially those with administrative privileges, should be aware of this vulnerability and take necessary actions to mitigate it. Operators, platforms, and security teams should review vulnerability management and assess potential impact on their environments. Additional stakeholders may include IT teams, cybersecurity professionals, and compliance officers who need to ensure the vulnerability is addressed.

Technical summary

The GazellePW commit 86c4bedf727691b5a97af42a4864869d18446449 contains a Stored XSS vulnerability in the donor avatar mouse-over text feature. The vulnerability is caused by the lack of proper sanitization of the avatar_mouse_over_text parameter, which allows remote authenticated users to inject arbitrary JavaScript. Affected product deployments should be verified, and owners assigned for follow-up. The vulnerability has a medium severity with a CVSS score of 5.4.

Defensive priority

Authenticated users with limited privileges can inject JavaScript into tooltips, posing a medium-severity risk. Verify avatar_mouse_over_text input sanitization.

Recommended defensive actions

Verify and sanitize avatar_mouse_over_text input
Restrict user roles and privileges
Monitor for suspicious tooltip content
Review compensating controls for exposed systems
Check relevant monitoring, detection, and logs for exposed assets
Track exceptions, retest remediated assets
Plan vendor-supported updates or mitigations

Evidence notes

Stored XSS in GazellePW's donor avatar mouse-over text via avatar_mouse_over_text parameter. Official CVE and NVD records provide details. Evidence is limited; verify avatar_mouse_over_text input sanitization and monitor for suspicious tooltip content. Defensive priority is medium; verify and sanitize input, restrict user roles and privileges. Additional verification tasks are required due to limited source detail.

Sources and references

Verified primary and authoritative sources

CVE-2026-38465 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-38465

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-38465 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-38465

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://github.com/Mosasauroidea/GazellePW/blob/86c4bedf727691b5a97af42a4864869d18446449/app/Manager/Donation.php

[email protected]
Source reference
Unverified legacy reference

URL: https://github.com/Mosasauroidea/GazellePW/blob/86c4bedf727691b5a97af42a4864869d18446449/classes/users.class.php

[email protected]
Source reference
Unverified legacy reference

URL: https://github.com/Mosasauroidea/GazellePW/blob/86c4bedf727691b5a97af42a4864869d18446449/sections/user/user.php

[email protected]
Source reference
Unverified legacy reference

URL: https://snaacky.com/1-click-exploit-chain-for-complete-gazellepw-database-compromise

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.