XI
Vendor
Xibosignage
43
CVEs
0
On KEV
5
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-50542 New | XI xibo-cms xibosignage | 5.4 | Oct 28 | Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure |
| CVE-2026-50543 New | XI xibo-cms xibosignage | 4.3 | Oct 28 | Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices |
| CVE-2026-50539 New | XI xibo-cms xibosignage | 6.5 | Oct 28 | Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments |
| CVE-2026-50541 New | XI xibo-cms xibosignage | 6.5 | Oct 28 | Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export |
| CVE-2026-52729 New | XI xibo-cms xibosignage | 7.1 | Oct 28 | Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion |
| CVE-2026-52730 | XI xibo-cms xibosignage | 4.3 | Aug 31 | Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence |
| CVE-2026-42558 | XI xibo-cms xibosignage | 7.6 | Jun 10 | Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet |
| CVE-2026-42141 | XI xibo-cms xibosignage | 7.7 | May 12 | Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality |
| CVE-2026-31956 | XI xibo-cms xibosignage | 4.3 | Apr 24 | Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization |
| CVE-2026-31955 | XI xibo-cms xibosignage | 4.9 | Apr 24 | Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality |
| CVE-2026-31953 | XI xibo-cms xibosignage | 5.4 | Apr 24 | Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login |
| CVE-2026-31952 | XI xibo-cms xibosignage | 8.1 | Apr 24 | Xibo CMS API has SQL Injection via DataSet Filter Parameter |
| CVE-2025-62369 | XI xibo-cms xibosignage | 7.2 | Nov 4 | Xibo CMS: Remote Code Execution through module templates |
| CVE-2024-43413 | XI xibo-cms xibosignage | 4.8 | Sep 3 | Xibo CMS XSS vulnerability using DataSet HTML columns |
| CVE-2024-43412 | XI xibo-cms xibosignage | 5.4 | Sep 3 | Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS |
| CVE-2024-41944 | XI xibo-cms xibosignage | 6.5 | Jul 30 | Sensitive Information Disclosure abusing SQL Injection in Xibo CMS proof of play report |
| CVE-2024-41804 | XI xibo-cms xibosignage | 6.5 | Jul 30 | Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula |
| CVE-2024-41802 | XI xibo-cms xibosignage | 8.1 | Jul 30 | Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import |
| CVE-2024-41803 | XI xibo-cms xibosignage | 4.9 | Jul 30 | Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter |
| CVE-2024-29022 | XI xibo-cms xibosignage | 8.8 | Apr 12 | Session Hijacking via XSS attack in header and session grid in Xibo CMS |
| CVE-2024-29023 | XI xibo-cms xibosignage | 7.2 | Apr 12 | Session Hijacking via token exposure on the session page in Xibo CMS |
| CVE-2023-33181 | XI Xibo Xibosignage | 5.3 | May 30 | Xibo is a content management system (CMS) |
| CVE-2023-33180 | XI Xibo Xibosignage | 6.5 | May 30 | Xibo is a content management system (CMS) |
| CVE-2023-33179 | XI Xibo Xibosignage | 6.5 | May 30 | Xibo is a content management system (CMS) |
| CVE-2023-33178 | XI Xibo Xibosignage | 6.5 | May 30 | Xibo is a content management system (CMS) |
| CVE-2023-33177 | XI Xibo Xibosignage | 8.8 | May 30 | Xibo is a content management system (CMS) |
| CVE-2013-4889 | XI Xibo Xibosignage | – | Jan 29 | Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authentication of administrators for… |
| CVE-2013-4888 | XI Xibo Xibosignage | – | Jan 29 | Cross-site scripting (XSS) vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the… |
| CVE-2013-4887 | XI Xibo Xibosignage | – | Jan 29 | SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to execute arbitrary SQL commands via the displayid parameter |
| CVE-2013-5979 | XI Xibo Xibosignage | – | Oct 2 | Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary files via a |