Skip to content
OpenAdvisories

Vendor

Xibo Signage

28 known vulnerabilities.

Products

xibo-cms 28
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.1
    CVE-2026-52729

    Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion

    Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `PUT/DELETE /action/{id}` allow an authenticated user to modify or delete actions on any…

    Xibo Signage xibo-cms
  • High 7.6
    CVE-2026-42558

    Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet

    Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.2, a vulnerability chain consisting of Stored XSS and Iframe Sandbox escape in the Xibo CMS allows users with DataSet permis…

    Xibo Signage xibo-cms
  • High 7.7
    CVE-2026-42141 Public exploit

    Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality

    Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability in the Xibo CMS allows users with Library upload permis…

    Xibo Signage xibo-cms
  • High 7.6
    CVE-2026-31952

    Xibo CMS API has SQL Injection via DataSet Filter Parameter

    Xibo is an open source digital signage platform with a web content management system and Windows display player software. Versions 1.7 through 4.4.0 have an SQL injection vulnerability in the API routes inside the CMS responsible for Filtering DataSets. This …

    Xibo Signage xibo-cms
  • High 7.2
    CVE-2025-62369 Public exploit

    Xibo CMS: Remote Code Execution through module templates

    Xibo is an open source digital signage platform with a web content management system (CMS). Versions 4.3.0 and below contain a Remote Code Execution vulnerability in the CMS Developer menu's Module Templating functionality, allowing authenticated users with "…

    Xibo Signage xibo-cms
  • High 8.1
    CVE-2024-41802

    Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import

    Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by in…

    Xibo Signage xibo-cms
  • High 8.8
    CVE-2024-29022

    Session Hijacking via XSS attack in header and session grid in Xibo CMS

    Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be…

    Xibo Signage xibo-cms
  • High 7.2
    CVE-2024-29023

    Session Hijacking via token exposure on the session page in Xibo CMS

    Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used t…

    Xibo Signage xibo-cms
  • High 8.8
    CVE-2023-33177 Public exploit

    Xibo CMS vulnerable to Remote Code Execution through Zip Slip

    Xibo is a content management system (CMS). A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be uploaded to the CMS via the layout import function by an authenticated user which would allow creation of files outsid…

    Xibo Signage xibo-cms