XI
Product
xibo-cms
21
CVEs
0
On KEV
8.8
Max CVSS
5
New 30D
Severity mix
Critical 0High 8Medium 13Low 0
Watch
Add xibo-cms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-29022 | 8.8 | Apr 12 | Session Hijacking via XSS attack in header and session grid in Xibo CMS Affected: >=1.8.0, < 3.3.10; >= 4.0.0, < 4.0.9 |
| CVE-2026-31952 | 8.1 | Apr 24 | Xibo CMS API has SQL Injection via DataSet Filter Parameter Affected: >= 1.7, < 4.4.1 |
| CVE-2024-41802 | 8.1 | Jul 30 | Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import Affected: => 1.8.0, < 3.3.12; => 4.0.0-alpha, < 4.0.14 |
| CVE-2026-42141 | 7.7 | May 12 | Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality Affected: < 4.4.1 |
| CVE-2026-42558 | 7.6 | Jun 10 | Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet Affected: < 4.4.2 |
| CVE-2025-62369 | 7.2 | Nov 4 | Xibo CMS: Remote Code Execution through module templates Affected: < 4.3.1 |
| CVE-2024-29023 | 7.2 | Apr 12 | Session Hijacking via token exposure on the session page in Xibo CMS Affected: >= 1.8.0, < 3.3.10; >= 4.0.0, < 4.0.9 |
| CVE-2026-52729 New | 7.1 | Oct 28 | Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion Affected: < 4.4.3 |
| CVE-2026-50539 New | 6.5 | Oct 28 | Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments Affected: < 4.4.3 |
| CVE-2026-50541 New | 6.5 | Oct 28 | Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export Affected: < 4.4.3 |
| CVE-2024-41944 | 6.5 | Jul 30 | Sensitive Information Disclosure abusing SQL Injection in Xibo CMS proof of play report Affected: => 2.1.0, < 3.3.12; => 4.0.0-alpha, < 4.0.14 |
| CVE-2024-41804 | 6.5 | Jul 30 | Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula Affected: => 2.1.0, < 3.3.12; => 4.0.0-alpha, < 4.0.14 |
| CVE-2026-50542 New | 5.4 | Oct 28 | Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure Affected: < 4.4.3 |
| CVE-2026-31953 | 5.4 | Apr 24 | Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login Affected: < 4.4.1 |
| CVE-2024-43412 | 5.4 | Sep 3 | Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS Affected: < 4.1.0 |
| CVE-2026-31955 | 4.9 | Apr 24 | Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality Affected: < 4.4.1 |
| CVE-2024-41803 | 4.9 | Jul 30 | Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter Affected: => 2.1.0, < 3.3.12; => 4.0.0-alpha, < 4.0.14 |
| CVE-2024-43413 | 4.8 | Sep 3 | Xibo CMS XSS vulnerability using DataSet HTML columns Affected: < 4.1.0 |
| CVE-2026-50543 New | 4.3 | Oct 28 | Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices Affected: < 4.4.3 |
| CVE-2026-52730 | 4.3 | Aug 31 | Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence Affected: < 4.4.3 |
| CVE-2026-31956 | 4.3 | Apr 24 | Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization Affected: < 4.4.1 |
Showing 21