XI
Product
xibo-cms
26
CVEs
0
On KEV
8.8
Max CVSS
5
New 30D
Severity mix
Critical 0High 9Medium 17Low 0
Watch
Add xibo-cms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-50539 New | 6.5 | Oct 28 | Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments Affected: < 4.4.3 |
| CVE-2026-50541 New | 6.5 | Oct 28 | Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export Affected: < 4.4.3 |
| CVE-2024-41944 | 6.5 | Jul 30 | Sensitive Information Disclosure abusing SQL Injection in Xibo CMS proof of play report Affected: => 2.1.0, < 3.3.12; => 4.0.0-alpha, < 4.0.14 |
| CVE-2024-41804 | 6.5 | Jul 30 | Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula Affected: => 2.1.0, < 3.3.12; => 4.0.0-alpha, < 4.0.14 |
| CVE-2023-33180 | 6.5 | May 30 | Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display map Affected: >= 3.2.0, < 3.3.5 |
| CVE-2023-33179 | 6.5 | May 30 | Sensitive Information Disclosure abusing SQL Injection in Xibo CMS nameFilter Affected: >= 3.2.0, < 3.3.5 |
| CVE-2023-33178 | 6.5 | May 30 | Sensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filter Affected: >= 1.4.0, < 2.3.17; >= 3.0.0, < 3.3.5 |
| CVE-2026-50542 New | 5.4 | Oct 28 | Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure Affected: < 4.4.3 |
| CVE-2026-31953 | 5.4 | Apr 24 | Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login Affected: < 4.4.1 |
| CVE-2024-43412 | 5.4 | Sep 3 | Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS Affected: < 4.1.0 |
| CVE-2023-33181 | 5.3 | May 30 | Sensitive Information Disclosure abusing Stack Trace in Xibo CMS Affected: >= 3.0.0, < 3.3.5 |
| CVE-2026-31955 | 4.9 | Apr 24 | Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality Affected: < 4.4.1 |
| CVE-2024-41803 | 4.9 | Jul 30 | Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter Affected: => 2.1.0, < 3.3.12; => 4.0.0-alpha, < 4.0.14 |
| CVE-2024-43413 | 4.8 | Sep 3 | Xibo CMS XSS vulnerability using DataSet HTML columns Affected: < 4.1.0 |
| CVE-2026-50543 New | 4.3 | Oct 28 | Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices Affected: < 4.4.3 |
| CVE-2026-52730 | 4.3 | Aug 31 | Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence Affected: < 4.4.3 |
| CVE-2026-31956 | 4.3 | Apr 24 | Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization Affected: < 4.4.1 |
Showing 17