Xibosignage vulnerabilities

Products

• Xibo-cms 26
• Xibo 22

Newest

• xibosignage xibo-cms Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure CVE-2026-50542 5.4 MediumOctober 28, 2026
• xibosignage xibo-cms Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices CVE-2026-50543 4.3 MediumOctober 28, 2026
• xibosignage xibo-cms Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments CVE-2026-50539 6.5 MediumOctober 28, 2026
• xibosignage xibo-cms Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export CVE-2026-50541 6.5 MediumOctober 28, 2026
• xibosignage xibo-cms Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion CVE-2026-52729 7.1 HighOctober 28, 2026
• xibosignage xibo-cms Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence CVE-2026-52730 4.3 MediumAugust 31, 2026
• xibosignage xibo-cms Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet CVE-2026-42558 7.6 HighJune 10, 2026
• xibosignage xibo-cms Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality CVE-2026-42141 Public exploit 7.7 HighMay 12, 2026
• xibosignage xibo, xibo-cms +1 more Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization CVE-2026-31956 4.3 MediumApril 24, 2026
• xibosignage xibo, xibo-cms +1 more Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality CVE-2026-31955 4.9 MediumApril 24, 2026
• xibosignage xibo, xibo-cms +1 more Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login CVE-2026-31953 6.4 MediumApril 24, 2026
• xibosignage xibo, xibo-cms +1 more Xibo CMS API has SQL Injection via DataSet Filter Parameter CVE-2026-31952 7.6 HighApril 24, 2026
• xibosignage xibo, xibo-cms +1 more Xibo CMS: Remote Code Execution through module templates CVE-2025-62369 Public exploit 7.2 HighNovember 4, 2025
• xibosignage xibo, xibo-cms +1 more Xibo CMS XSS vulnerability using DataSet HTML columns CVE-2024-43413 3.5 LowSeptember 3, 2024
• xibosignage xibo, xibo-cms +1 more Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS CVE-2024-43412 4.6 MediumSeptember 3, 2024
• xibosignage xibo, xibo-cms +1 more Sensitive Information Disclosure abusing SQL Injection in Xibo CMS proof of play report CVE-2024-41944 6.5 MediumJuly 30, 2024
• xibosignage xibo, xibo-cms +1 more Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula CVE-2024-41804 6.5 MediumJuly 30, 2024
• xibosignage xibo, xibo-cms +1 more Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import CVE-2024-41802 8.1 HighJuly 30, 2024
• xibosignage xibo, xibo-cms +1 more Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter CVE-2024-41803 4.9 MediumJuly 30, 2024
• xibosignage xibo, xibo-cms +1 more Session Hijacking via XSS attack in header and session grid in Xibo CMS CVE-2024-29022 8.8 HighApril 12, 2024
• xibosignage xibo, xibo-cms +1 more Session Hijacking via token exposure on the session page in Xibo CMS CVE-2024-29023 7.2 HighApril 12, 2024
• xibosignage xibo, xibo-cms +1 more Sensitive Information Disclosure abusing Stack Trace in Xibo CMS CVE-2023-33181 4.3 MediumMay 30, 2023
• xibosignage xibo, xibo-cms +1 more Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display map CVE-2023-33180 6.5 MediumMay 30, 2023
• xibosignage xibo, xibo-cms +1 more Sensitive Information Disclosure abusing SQL Injection in Xibo CMS nameFilter CVE-2023-33179 6.5 MediumMay 30, 2023
• xibosignage xibo, xibo-cms +1 more Sensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filter CVE-2023-33178 6.5 MediumMay 30, 2023
• xibosignage xibo, xibo-cms +1 more Xibo CMS vulnerable to Remote Code Execution through Zip Slip CVE-2023-33177 Public exploit 8.8 HighMay 30, 2023
• xibosignage xibo Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital Signage Xibo 1... CVE-2013-4889 Public exploit 6.8 MediumJanuary 29, 2014
• xibosignage xibo Cross-site scripting (XSS) vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote... CVE-2013-4888 Public exploit 4.3 MediumJanuary 29, 2014
• xibosignage xibo SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to... CVE-2013-4887 7.5 HighJanuary 29, 2014
• xibosignage xibo Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4... CVE-2013-5979 Public exploit EPSS 18.1% 5.0 MediumOctober 2, 2013