IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2024-12-30 17:15

MODIFIED

2024-12-30 17:15

EPSS (Prob. Exploit)

0.65%

Top 49.5%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-03-01

> DESCRIPTION

LGSL (Live Game Server List) provides online status lists for online video games. Versions up to and including 6.2.1 contain a reflected cross-site scripting vulnerability in the `Referer` HTTP header. The vulnerability allows attackers to inject arbitrary JavaScript code, which is reflected in the HTML response without proper sanitization. When crafted malicious input is provided in the `Referer` header, it is echoed back into an HTML attribute in the application’s response. Commit 7ecb839df9358d21f64cdbff5b2536af25a77de1 contains a patch for the issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-ggwq-xc72-33r3 MODERATE

LGSL has a reflected XSS at /lgsl_files/lgsl_list.php

AFFECTED PACKAGES:

COMPOSER / tltneon/lgsl

<= 6.2.1

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

LGSL has a reflected XSS at /lgsl_files/lgsl_list.php

AFFECTED PACKAGES:

Unknown / Unknown

16 versions affected

ALIASES:

GHSA-ggwq-xc72-33r3

> HISTORIQUE DES MODIFICATIONS

Première apparition

30/12/2024 17:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 14:58

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui