XI
Product
xibo-cms
21
CVEs
0
On KEV
8.8
Max CVSS
5
New 30D
Severity mix
Critical 0High 8Medium 13Low 0
Watch
Add xibo-cms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-29022 | 8.8 | Apr 12 | Session Hijacking via XSS attack in header and session grid in Xibo CMS Affected: >=1.8.0, < 3.3.10; >= 4.0.0, < 4.0.9 |
| CVE-2026-31952 | 8.1 | Apr 24 | Xibo CMS API has SQL Injection via DataSet Filter Parameter Affected: >= 1.7, < 4.4.1 |
| CVE-2024-41802 | 8.1 | Jul 30 | Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import Affected: => 1.8.0, < 3.3.12; => 4.0.0-alpha, < 4.0.14 |
| CVE-2026-42141 | 7.7 | May 12 | Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality Affected: < 4.4.1 |
| CVE-2026-42558 | 7.6 | Jun 10 | Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet Affected: < 4.4.2 |
| CVE-2025-62369 | 7.2 | Nov 4 | Xibo CMS: Remote Code Execution through module templates Affected: < 4.3.1 |
| CVE-2024-29023 | 7.2 | Apr 12 | Session Hijacking via token exposure on the session page in Xibo CMS Affected: >= 1.8.0, < 3.3.10; >= 4.0.0, < 4.0.9 |
| CVE-2026-52729 New | 7.1 | Oct 28 | Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion Affected: < 4.4.3 |
Showing 8