TI-2023-16357 Aliases CVE-2023-33180

Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display map

LOW 30CWE-89Published 2023-05-30 · Updated 2025-01-09

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.2 in the `/display/map` API route inside the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values in to the `bounds` parameter. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00621 50th percentileScored 2026-11-07

Fix Fixed xibo-cms (xibosignage): 3.3.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
xibosignage	xibo-cms	3.2.0 to before 3.3.5	3.3.5	Patch available	CNA

xibo-cms Vendorxibosignage Affected 3.2.0 to before 3.3.5 Fixed in 3.3.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:xibosignage:xibo::::::::	3.2.0 to before 3.3.5	Vulnerable	xibosignage

cpe:2.3:a:xibosignage:xibo:*:*:*:*:*:*:*:* Versions 3.2.0 to before 3.3.5 Vulnerable ·xibosignage

Remediation

Fix · CNA xibo-cms (xibosignage) Fixed in 3.3.5

Timeline

2026-10-02 Threatist record created from CVE-2023-33180
2026-11-07 EPSS moved to the 50th–90th percentile

References

Advisory 3

TI-2023-16354 Xibo CMS vulnerable to Remote Code Execution through Zip Slip CVSS 3.1HIGH 8.8
TI-2013-05097 Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x… CVSS 2.0MEDIUM 5.0
TI-2024-27847 Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import CVSS 3.1HIGH 8.1
TI-2025-38637 Xibo CMS: Remote Code Execution through module templates CVSS 3.1HIGH 7.2
TI-2026-24496 Xibo CMS API has SQL Injection via DataSet Filter Parameter CVSS 3.1HIGH 8.1
TI-2013-04290 SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote… CVSS 2.0HIGH 7.5

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences