Xibosignage vulnerabilities
26 CVEs and advisories name Xibosignage as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-50542Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure
- CVE-2026-50543Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices
- CVE-2026-50539Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments
- CVE-2026-50541Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export
- CVE-2026-52729Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion
- CVE-2026-52730Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence
- CVE-2026-42558Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet
- CVE-2026-42141Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality
- CVE-2026-31956Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization
- CVE-2026-31955Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality
- CVE-2026-31953Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login
- CVE-2026-31952Xibo CMS API has SQL Injection via DataSet Filter Parameter
- CVE-2025-62369Xibo CMS: Remote Code Execution through module templates
- CVE-2024-43413Xibo CMS XSS vulnerability using DataSet HTML columns
- CVE-2024-43412Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS
- CVE-2024-41944Sensitive Information Disclosure abusing SQL Injection in Xibo CMS proof of play report
- CVE-2024-41804Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula
- CVE-2024-41802Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import
- CVE-2024-41803Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter
- CVE-2024-29022Session Hijacking via XSS attack in header and session grid in Xibo CMS
- CVE-2024-29023Session Hijacking via token exposure on the session page in Xibo CMS
- CVE-2023-33181Sensitive Information Disclosure abusing Stack Trace in Xibo CMS
- CVE-2023-33180Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display map
- CVE-2023-33179Sensitive Information Disclosure abusing SQL Injection in Xibo CMS nameFilter
- CVE-2023-33178Sensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filter
- CVE-2023-33177Xibo CMS vulnerable to Remote Code Execution through Zip Slip