{"id":"CVE-2024-56361","aliases":["GHSA-xx95-62h6-h7v3"],"url":"https://o3.security/vulnerability/CVE-2024-56361","summary":"Stored Cross-Site Scripting (XSS) in lgsl v7.0","details":"LGSL (Live Game Server List) provides online status for games. Before 7.0.0, a stored cross-site scripting (XSS) vulnerability was identified in lgsl. The function lgsl_query_40 in lgsl_protocol.php has implemented an HTTP crawler. This function makes a request to the registered game server, and upon crawling the malicious /info endpoint with our payload, will render our javascript on the info page. This information is being displayed via lgsl_details.php. This vulnerability is fixed in 7.0.0.","published":"2024-12-26T21:59:01.775Z","modified":"2026-07-15T01:48:51.920965828Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"tltneon/lgsl","fixedVersion":"7.0.0"}],"fix":{"url":"https://github.com/tltneon/lgsl/commit/3fbd3bb581b636f7fd3ea0592c5f8df87d3a2843","label":"tltneon/lgsl@3fbd3bb"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56361.json"},{"type":"ADVISORY","url":"https://github.com/tltneon/lgsl/security/advisories/GHSA-xx95-62h6-h7v3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56361"},{"type":"FIX","url":"https://github.com/tltneon/lgsl/commit/3fbd3bb581b636f7fd3ea0592c5f8df87d3a2843"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:48:51.920965828Z"}}