This vulnerability is a reflected or stored cross-site scripting (CWE-79) issue in the Gazelle software, specifically in the /managers/multiple_freeleech.php file at commit 63b3370. An attacker can supply a malicious payload via the torrents parameter, which is not properly sanitized, leading to execution of arbitrary scripts or HTML in the context of the victim's browser. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim user, potentially leading to theft of sensitive information, session hijacking, or other actions performed with the victim's privileges. The impact is limited to confidentiality and integrity, with no direct availability impact. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the affected component or applying input validation and output encoding on the torrents parameter to mitigate XSS risks. Monitor official Gazelle project communications for updates on patches or official fixes.