What’s Vulnerable › Products
xibosignage xibo-cms vulnerabilities
25 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.
Check whether your xibosignage xibo-cms version is affected
Latest xibosignage xibo-cms vulnerabilities
- CVE-2026-50542 — Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure (CVSS 5.4)
- CVE-2026-50543 — Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices (CVSS 4.3)
- CVE-2026-50539 — Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments (CVSS 6.5)
- CVE-2026-50541 — Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export (CVSS 6.5)
- CVE-2026-52729 — Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion (CVSS 7.1)
- CVE-2026-52730 — Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence (CVSS 4.3)
- CVE-2026-42558 — Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet (CVSS 7.6)
- CVE-2026-42141 — Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality (CVSS 7.7)
- CVE-2026-31956 — Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization (CVSS 4.3)
- CVE-2026-31955 — Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality (CVSS 4.9)
- CVE-2026-31953 — Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login (CVSS 5.4)
- CVE-2026-31952 — Xibo CMS API has SQL Injection via DataSet Filter Parameter (CVSS 8.1)
- CVE-2025-62369 — Xibo CMS: Remote Code Execution through module templates (CVSS 7.2)
- CVE-2024-43413 — Xibo CMS XSS vulnerability using DataSet HTML columns (CVSS 4.8)
- CVE-2024-43412 — Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS (CVSS 5.4)
- CVE-2024-41944 — Sensitive Information Disclosure abusing SQL Injection in Xibo CMS proof of play report (CVSS 6.5)
- CVE-2024-41804 — Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula (CVSS 6.5)
- CVE-2024-41803 — Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter (CVSS 4.9)
- CVE-2024-41802 — Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import (CVSS 8.1)
- CVE-2024-29023 — Session Hijacking via token exposure on the session page in Xibo CMS (CVSS 7.2)
- CVE-2024-29022 — Session Hijacking via XSS attack in header and session grid in Xibo CMS (CVSS 8.8)
- CVE-2023-33181 — Sensitive Information Disclosure abusing Stack Trace in Xibo CMS (CVSS 5.3)
- CVE-2023-33180 — Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display map (CVSS 6.5)
- CVE-2023-33179 — Sensitive Information Disclosure abusing SQL Injection in Xibo CMS nameFilter (CVSS 6.5)
- CVE-2023-33178 — Sensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filter (CVSS 6.5)