xibosignage

Records32All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high10CVSS 7.0–8.9

Exploited now

xibosignage records in CISA KEV

No xibosignage vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Xibo 19 records MEDIUM

Records

32 records

TI-2023-16354 CVE-2023-33177

Xibo CMS vulnerable to Remote Code Execution through Zip Slip

MEDIUM 50

Xibo is a content management system (CMS).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.07036 Published 2023-05-30 Fixed in 2.3.17, 3.3.5 CWE-22

TI-2024-19204 CVE-2024-29022

Session Hijacking via XSS attack in header and session grid in Xibo CMS

MEDIUM 41

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00698 Published 2024-04-12 Fixed in 3.3.10, 4.0.9 CWE-117

TI-2013-05097 CVE-2013-5979 · GHSA-qxrm-876q-9c6p

Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x…

MEDIUM 40

Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary files via a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.18125 Published 2013-10-02 No fix listed CWE-22

TI-2024-27847 CVE-2024-41802

Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import

LOW 38

Xibo is a content management system (CMS).

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00457 Published 2024-07-30 No fix listed CWE-89

TI-2025-38637 CVE-2025-62369

Xibo CMS: Remote Code Execution through module templates

LOW 36

Xibo is an open source digital signage platform with a web content management system (CMS).

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00961 Published 2025-11-04 Fixed in 4.3.1 CWE-1336

TI-2026-24496 CVE-2026-31952

Xibo CMS API has SQL Injection via DataSet Filter Parameter

LOW 35

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00246 Published 2026-04-24 Fixed in 4.4.1 CWE-184

TI-2024-19205 CVE-2024-29023

Session Hijacking via token exposure on the session page in Xibo CMS

LOW 35

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00802 Published 2024-04-12 Fixed in 3.3.10, 4.0.9 CWE-200

TI-2013-04290 CVE-2013-4887 · GHSA-3mgr-fjw4-mgpc

SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote…

LOW 35

SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to execute arbitrary SQL commands via the displayid parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0121 Published 2014-01-29 No fix listed CWE-89

TI-2026-30472 CVE-2026-42141

Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality

LOW 34

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00369 Published 2026-05-12 Fixed in 4.4.1 CWE-918

TI-2026-30838 CVE-2026-42558

Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet

LOW 32

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.0011 Published 2026-06-10 Fixed in 4.4.2 CWE-116

TI-2013-04292 CVE-2013-4889 · GHSA-xpfx-x75c-qcrh

Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital…

LOW 32

Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new administrator vi…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.00848 Published 2014-01-29 No fix listed CWE-352

TI-2026-81979 CVE-2026-52729

Missing authorization in Xibo CMS lets users change layout actions

LOW 31

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00292 Published 2026-10-28 Fixed in 4.4.3 CWE-862

TI-2024-27966 CVE-2024-41944

Sensitive Information Disclosure abusing SQL Injection in Xibo CMS proof of play report

LOW 31

Xibo is a content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00442 Published 2024-07-30 No fix listed CWE-89

TI-2024-27849 CVE-2024-41804

Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula

LOW 31

Xibo is a content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00435 Published 2024-07-30 No fix listed CWE-89

TI-2023-16357 CVE-2023-33180

Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display map

LOW 30

Xibo is a content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00621 Published 2023-05-30 Fixed in 3.3.5 CWE-89

TI-2023-16356 CVE-2023-33179

Sensitive Information Disclosure abusing SQL Injection in Xibo CMS nameFilter

LOW 30

Xibo is a content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00621 Published 2023-05-30 Fixed in 3.3.5 CWE-89

TI-2023-16355 CVE-2023-33178

Sensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filter

LOW 30

Xibo is a content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00626 Published 2023-05-30 Fixed in 2.3.17, 3.3.5 CWE-89

TI-2026-82001 CVE-2026-50539

Missing authorization in Xibo exposes notification attachments

LOW 29

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00368 Published 2026-10-28 Fixed in 4.4.3 CWE-862

TI-2026-81978 CVE-2026-50541

Missing authorization in Xibo CMS dataset CSV export exposes datasets

LOW 29

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00368 Published 2026-10-28 Fixed in 4.4.3 CWE-862

TI-2026-24497 CVE-2026-31953

Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login

LOW 27

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00141 Published 2026-04-24 Fixed in 4.4.1 CWE-79

TI-2024-27848 CVE-2024-41803

Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter

LOW 25

Xibo is a content management system (CMS).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00444 Published 2024-07-30 No fix listed CWE-89

TI-2023-16358 CVE-2023-33181

Sensitive Information Disclosure abusing Stack Trace in Xibo CMS

LOW 25

Xibo is a content management system (CMS).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00538 Published 2023-05-30 Fixed in 3.3.5 CWE-209

TI-2026-82002 CVE-2026-50542

Missing authorization in Xibo CMS exposes layout metadata

LOW 24

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00251 Published 2026-10-28 Fixed in 4.4.3 CWE-862

TI-2024-29061 CVE-2024-43412

Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS

LOW 24

Xibo is an open source digital signage platform with a web content management system (CMS).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00279 Published 2024-09-03 Fixed in 4.1.0 CWE-79

TI-2025-27438 CVE-2025-41088 · GHSA-f9qr-4pvr-52qg

Stored Cross-Site Scripting (XSS) in CMS

LOW 23

Stored Cross-Site Scripting (XSS) in Xibo Signage's Xibo CMS v4.1.2, due to a lack of proper validation of user input.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00373 Published 2025-10-10 Fixed in 4.2.2 CWE-79

Open these records in search →