Vulnerabilities

TI-2026-82002 CVE-2026-50542

Missing authorization in Xibo CMS exposes layout metadata

LOW 24

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00251 Published 2026-10-28 Fixed in 4.4.3 CWE-862

TI-2026-82003 CVE-2026-50543

Missing authorization in Xibo CMS lets users alter display schedules

LOW 19

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00222 Published 2026-10-28 Fixed in 4.4.3 CWE-862

TI-2026-82001 CVE-2026-50539

Missing authorization in Xibo exposes notification attachments

LOW 29

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00368 Published 2026-10-28 Fixed in 4.4.3 CWE-862

TI-2026-81978 CVE-2026-50541

Missing authorization in Xibo CMS dataset CSV export exposes datasets

LOW 29

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00368 Published 2026-10-28 Fixed in 4.4.3 CWE-862

TI-2026-81979 CVE-2026-52729

Missing authorization in Xibo CMS lets users change layout actions

LOW 31

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00292 Published 2026-10-28 Fixed in 4.4.3 CWE-862

TI-2026-37848 CVE-2026-52730

Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence

LOW 20

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00294 Published 2026-08-31 Fixed in 4.4.3 CWE-862

TI-2026-30838 CVE-2026-42558

Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet

LOW 32

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.0011 Published 2026-06-10 Fixed in 4.4.2 CWE-116

TI-2026-30472 CVE-2026-42141

Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality

LOW 34

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00369 Published 2026-05-12 Fixed in 4.4.1 CWE-918

TI-2026-24500 CVE-2026-31956

Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization

LOW 20

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00265 Published 2026-04-24 Fixed in 4.4.1 CWE-639

TI-2026-24499 CVE-2026-31955

Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality

LOW 22

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00282 Published 2026-04-24 Fixed in 4.4.1 CWE-918

TI-2026-24497 CVE-2026-31953

Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login

LOW 27

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00141 Published 2026-04-24 Fixed in 4.4.1 CWE-79

TI-2026-24496 CVE-2026-31952

Xibo CMS API has SQL Injection via DataSet Filter Parameter

LOW 35

Xibo is an open source digital signage platform with a web content management system and Windows display player software.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00246 Published 2026-04-24 Fixed in 4.4.1 CWE-184

TI-2025-38637 CVE-2025-62369

Xibo CMS: Remote Code Execution through module templates

LOW 36

Xibo is an open source digital signage platform with a web content management system (CMS).

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00961 Published 2025-11-04 Fixed in 4.3.1 CWE-1336

TI-2025-27439 CVE-2025-41089 · GHSA-p5m2-r7pq-fxr5

Reflected Cross-Site Scripting (XSS) in CMS

LOW 22

Reflected Cross-Site Scripting (XSS) in Xibo CMS v4.1.2 from Xibo Signage, due to a lack of proper validation of user input.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.003 Published 2025-10-10 Fixed in 4.2.2 CWE-79

TI-2025-27438 CVE-2025-41088 · GHSA-f9qr-4pvr-52qg

Stored Cross-Site Scripting (XSS) in CMS

LOW 23

Stored Cross-Site Scripting (XSS) in Xibo Signage's Xibo CMS v4.1.2, due to a lack of proper validation of user input.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00373 Published 2025-10-10 Fixed in 4.2.2 CWE-79

TI-2024-29062 CVE-2024-43413

Xibo CMS XSS vulnerability using DataSet HTML columns

LOW 22

Xibo is an open source digital signage platform with a web content management system (CMS).

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00279 Published 2024-09-03 Fixed in 4.1.0 CWE-79

TI-2024-29061 CVE-2024-43412

Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS

LOW 24

Xibo is an open source digital signage platform with a web content management system (CMS).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00279 Published 2024-09-03 Fixed in 4.1.0 CWE-79

TI-2024-27966 CVE-2024-41944

Sensitive Information Disclosure abusing SQL Injection in Xibo CMS proof of play report

LOW 31

Xibo is a content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00442 Published 2024-07-30 No fix listed CWE-89

TI-2024-27849 CVE-2024-41804

Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula

LOW 31

Xibo is a content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00435 Published 2024-07-30 No fix listed CWE-89

TI-2024-27847 CVE-2024-41802

Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import

LOW 38

Xibo is a content management system (CMS).

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00457 Published 2024-07-30 No fix listed CWE-89

TI-2024-27848 CVE-2024-41803

Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter

LOW 25

Xibo is a content management system (CMS).

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00444 Published 2024-07-30 No fix listed CWE-89

TI-2024-19204 CVE-2024-29022

Session Hijacking via XSS attack in header and session grid in Xibo CMS

MEDIUM 41

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00698 Published 2024-04-12 Fixed in 3.3.10, 4.0.9 CWE-117

TI-2024-19205 CVE-2024-29023

Session Hijacking via token exposure on the session page in Xibo CMS

LOW 35

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00802 Published 2024-04-12 Fixed in 3.3.10, 4.0.9 CWE-200

TI-2023-16358 CVE-2023-33181

Sensitive Information Disclosure abusing Stack Trace in Xibo CMS

LOW 25

Xibo is a content management system (CMS).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00538 Published 2023-05-30 Fixed in 3.3.5 CWE-209

TI-2023-16357 CVE-2023-33180

Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display map

LOW 30

Xibo is a content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00621 Published 2023-05-30 Fixed in 3.3.5 CWE-89

Vulnerabilities

Filters