CVE-2026-38467: SQL Injection

Published Aug 25, 2026

Updated

A SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with usersmod privileges to execute arbitrary SQL commands via the tagid or type parameter in a crafted POST request to tools.php?action=managetags.

Affected Software

1 affected component

GazellePW GazellePosterWall

Event History

Aug 25, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·10:17 PM

Description

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker must be remotely authenticated and have the users_mod privilege. Unauthenticated users and authenticated users without that privilege are not identified as able to exploit it.

Which endpoint and inputs are involved?

The affected request is a crafted POST request to tools.php?action=manage_tags. The injectable inputs are the tagid and type parameters.

What is the potential impact of successful exploitation?

A successful attacker can execute arbitrary SQL commands through the application's tags manager.

CVE-2026-38467: SQL Injection

Affected Software

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

Which endpoint and inputs are involved?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

Which endpoint and inputs are involved?

What is the potential impact of successful exploitation?