Skip to contentXibosignage Xibo-cms vulnerabilities
- xibosignage xibo-cmsXibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata DisclosureCVE-2026-505425.4 Medium
- xibosignage xibo-cmsXibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player DevicesCVE-2026-505434.3 Medium
- xibosignage xibo-cmsXibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary AttachmentsCVE-2026-505396.5 Medium
- xibosignage xibo-cmsXibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset ExportCVE-2026-505416.5 Medium
- xibosignage xibo-cmsXibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and DeletionCVE-2026-527297.1 High
- xibosignage xibo-cmsXibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedenceCVE-2026-527304.3 Medium
- xibosignage xibo-cmsXibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSetCVE-2026-425587.6 High
- xibosignage xibo-cmsXibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionalityCVE-2026-42141Public exploit7.7 High
- xibosignage xibo, xibo-cms +1 moreXibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorizationCVE-2026-319564.3 Medium
- xibosignage xibo, xibo-cms +1 moreXibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet FunctionalityCVE-2026-319554.9 Medium
- xibosignage xibo, xibo-cms +1 moreXibo CMS has Stored XSS via Notification Body with Zero-Click Execution on LoginCVE-2026-319536.4 Medium
- xibosignage xibo, xibo-cms +1 moreXibo CMS API has SQL Injection via DataSet Filter ParameterCVE-2026-319527.6 High
- xibosignage xibo, xibo-cms +1 moreXibo CMS: Remote Code Execution through module templatesCVE-2025-62369Public exploit7.2 High
- xibosignage xibo, xibo-cms +1 moreXibo CMS XSS vulnerability using DataSet HTML columnsCVE-2024-434133.5 Low
- xibosignage xibo, xibo-cms +1 moreXibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JSCVE-2024-434124.6 Medium
- xibosignage xibo, xibo-cms +1 moreSensitive Information Disclosure abusing SQL Injection in Xibo CMS proof of play reportCVE-2024-419446.5 Medium
- xibosignage xibo, xibo-cms +1 moreXibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column FormulaCVE-2024-418046.5 Medium
- xibosignage xibo, xibo-cms +1 moreXibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data ImportCVE-2024-418028.1 High
- xibosignage xibo, xibo-cms +1 moreXibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet FilterCVE-2024-418034.9 Medium
- xibosignage xibo, xibo-cms +1 moreSession Hijacking via XSS attack in header and session grid in Xibo CMSCVE-2024-290228.8 High
- xibosignage xibo, xibo-cms +1 moreSession Hijacking via token exposure on the session page in Xibo CMSCVE-2024-290237.2 High
- xibosignage xibo, xibo-cms +1 moreSensitive Information Disclosure abusing Stack Trace in Xibo CMSCVE-2023-331814.3 Medium
- xibosignage xibo, xibo-cms +1 moreSensitive Information Disclosure abusing SQL Injection in Xibo CMS display mapCVE-2023-331806.5 Medium
- xibosignage xibo, xibo-cms +1 moreSensitive Information Disclosure abusing SQL Injection in Xibo CMS nameFilterCVE-2023-331796.5 Medium
- xibosignage xibo, xibo-cms +1 moreSensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filterCVE-2023-331786.5 Medium
- xibosignage xibo, xibo-cms +1 moreXibo CMS vulnerable to Remote Code Execution through Zip SlipCVE-2023-33177Public exploit8.8 High