CVE-2026-38468

Name of the Vulnerable Software and Affected Versions GazellePW (GazellePosterWall) versions prior to commit 86c4bedf727691b5a97af42a4864869d18446449

Description An issue exists in the country-code lookup endpoint that allows remote authenticated users with users view ips privileges to execute arbitrary SQL commands. This is achieved by sending a crafted request to the 'tools.php?action=get cc' endpoint using the ip parameter. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations Update GazellePW (GazellePosterWall) to commit 86c4bedf727691b5a97af42a4864869d18446449 or later. As a temporary mitigation, restrict access to the 'tools.php?action=get cc' endpoint or avoid using the ip parameter until the update is applied.