“Can you try a game I made?” Fake game sites lead to information stealers

The background and the IOCs for this blog were gathered by an Expert helper on our forums and Malwarebytes researchers. Our thanks go out to them. A new, malicious campaign is making the rounds online and it starts simple: Unwitting targets receive a direct message DM on a Discord server asking...

CVE-2024-56517

LGSL (Live Game Server List) is affected by CVE-2024-56517 with a reflected XSS in the Referer header affecting versions up to 6.2.1. Attackers can inject arbitrary JavaScript that is echoed back into an HTML attribute in the response due to insufficient sanitization. The issue is caused by using...

LGSL 跨站脚本漏洞

LGSL Live Game Server List is a list of live game servers by Neon Personal Developers. A cross-site scripting vulnerability exists in LGSL version 6.2.1, which stems from the inclusion of a reflective cross-site scripting vulnerability that allows an attacker to inject arbitrary JavaScript code...

PT-2024-36827 · Lgsl · Lgsl

Name of the Vulnerable Software and Affected Versions: LGSL Live Game Server List versions up to and including 6.2.1 Description: The issue is related to a reflected cross-site scripting vulnerability in the Referer HTTP header. This vulnerability allows attackers to inject arbitrary JavaScript...

CVE-2024-56361 Stored Cross-Site Scripting (XSS) in lgsl v7.0

LGSL Live Game Server List provides online status for games. Before 7.0.0, a stored cross-site scripting XSS vulnerability was identified in lgsl. The function lgslquery40 in lgslprotocol.php has implemented an HTTP crawler. This function makes a request to the registered game server, and upon...

GHSA-XX95-62H6-H7V3 lgsl Stored Cross-Site Scripting vulnerability

Summary A stored cross-site scripting XSS vulnerability was identified in lgsl. The issue arises from improper sanitation of user input. Everyone who accesses this page will be affected by this attack. Details The function lgslquery40 in lgslprotocol.php has implemented an HTTP crawler. This...

LGSL 跨站脚本漏洞

LGSL Live Game Server List is a list of live game servers by Neon Personal Developers. A cross-site scripting vulnerability exists in LGSL versions prior to 7.0.0, which stems from vulnerability to cross-site scripting attacks...

PT-2024-17782 · Unknown · Treasurehuntgame Treasurehunt

Name of the Vulnerable Software and Affected Versions: TreasureHuntGame TreasureHunt up to 963e0e0 Description: A critical vulnerability has been found in TreasureHuntGame TreasureHunt. The issue affects the console log function of the file TreasureHunt/checkflag.php. The manipulation of the...

CVE-2024-46939

The game extension engine of versions 1.2.7.0 and earlier exposes some components, and attackers can construct parameters to perform path traversal attacks, which can overwrite local specific files...

CVE-2024-46939 Game Extension Engine Path Traversal Vulnerability

The game extension engine of versions 1.2.7.0 and earlier exposes some components, and attackers can construct parameters to perform path traversal attacks, which can overwrite local specific files...

CVE-2024-46939 Game Extension Engine Path Traversal Vulnerability

The game extension engine of versions 1.2.7.0 and earlier exposes some components, and attackers can construct parameters to perform path traversal attacks, which can overwrite local specific files...

PT-2024-32290 · Unknown · Game Extension Engine

Name of the Vulnerable Software and Affected Versions: Game extension engine versions 1.2.7.0 and earlier Description: The game extension engine exposes some components, allowing attackers to construct parameters for path traversal attacks. These attacks can overwrite local specific files...

vivo Game Extension Engine 安全漏洞

The vivo Game Extension Engine is a game extension engine from the Chinese company Vivo. A security vulnerability exists in vivo Game Extension Engine version 1.2.7 and earlier, which stems from the Game Extension Engine exposing some components, allowing an attacker to construct parameters for a...

WordPress Dino Game plugin <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Dino Game versions = 1.1.0...

CVE-2024-11388

The Dino Game – Embed Google Chrome Dinosaur Game in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dino-game' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attribute...

CVE-2024-11388

The Dino Game – Embed Google Chrome Dinosaur Game in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dino-game' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attribute...

CVE-2024-11388

CVE-2024-11388 affects the WordPress plugin “Dino Game – Embed Google Chrome Dinosaur Game in WordPress” (

CVE-2024-11388 Dino Game – Embed Google Chrome Dinosaur Game in WordPress <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Dino Game – Embed Google Chrome Dinosaur Game in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dino-game' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attribute...

CVE-2024-11388 Dino Game – Embed Google Chrome Dinosaur Game in WordPress <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Dino Game – Embed Google Chrome Dinosaur Game in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dino-game' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attribute...

WordPress Dino Game Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Dino Game Type Plugin Vulnerable versions = 1.1.0 Fixed in 1.2.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-11388 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3063a938b1ce Credits SOPROBRO Required privilege...