# cve.now: Xibosignage

The newest entries naming Xibosignage as an affected vendor (up to 200), of 26 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-50542](https://cve.now/CVE-2026-50542.md): Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure (CVSS 5.4)
- [CVE-2026-50543](https://cve.now/CVE-2026-50543.md): Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices (CVSS 4.3)
- [CVE-2026-50539](https://cve.now/CVE-2026-50539.md): Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments (CVSS 6.5)
- [CVE-2026-50541](https://cve.now/CVE-2026-50541.md): Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export (CVSS 6.5)
- [CVE-2026-52729](https://cve.now/CVE-2026-52729.md): Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion (CVSS 7.1)
- [CVE-2026-52730](https://cve.now/CVE-2026-52730.md): Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence (CVSS 4.3)
- [CVE-2026-42558](https://cve.now/CVE-2026-42558.md): Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet (CVSS 7.6)
- [CVE-2026-42141](https://cve.now/CVE-2026-42141.md): Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality (CVSS 7.7)
- [CVE-2026-31956](https://cve.now/CVE-2026-31956.md): Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization (CVSS 4.3)
- [CVE-2026-31955](https://cve.now/CVE-2026-31955.md): Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality (CVSS 4.9)
- [CVE-2026-31953](https://cve.now/CVE-2026-31953.md): Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login (CVSS 6.4)
- [CVE-2026-31952](https://cve.now/CVE-2026-31952.md): Xibo CMS API has SQL Injection via DataSet Filter Parameter (CVSS 7.6)
- [CVE-2025-62369](https://cve.now/CVE-2025-62369.md): Xibo CMS: Remote Code Execution through module templates (CVSS 7.2)
- [CVE-2024-43413](https://cve.now/CVE-2024-43413.md): Xibo CMS XSS vulnerability using DataSet HTML columns (CVSS 3.5)
- [CVE-2024-43412](https://cve.now/CVE-2024-43412.md): Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS (CVSS 4.6)
- [CVE-2024-41944](https://cve.now/CVE-2024-41944.md): Sensitive Information Disclosure abusing SQL Injection in Xibo CMS proof of play report (CVSS 6.5)
- [CVE-2024-41804](https://cve.now/CVE-2024-41804.md): Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula (CVSS 6.5)
- [CVE-2024-41802](https://cve.now/CVE-2024-41802.md): Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import (CVSS 8.1)
- [CVE-2024-41803](https://cve.now/CVE-2024-41803.md): Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter (CVSS 4.9)
- [CVE-2024-29022](https://cve.now/CVE-2024-29022.md): Session Hijacking via XSS attack in header and session grid in Xibo CMS (CVSS 8.8)
- [CVE-2024-29023](https://cve.now/CVE-2024-29023.md): Session Hijacking via token exposure on the session page in Xibo CMS (CVSS 7.2)
- [CVE-2023-33181](https://cve.now/CVE-2023-33181.md): Sensitive Information Disclosure abusing Stack Trace in Xibo CMS (CVSS 4.3)
- [CVE-2023-33180](https://cve.now/CVE-2023-33180.md): Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display map (CVSS 6.5)
- [CVE-2023-33179](https://cve.now/CVE-2023-33179.md): Sensitive Information Disclosure abusing SQL Injection in Xibo CMS nameFilter (CVSS 6.5)
- [CVE-2023-33178](https://cve.now/CVE-2023-33178.md): Sensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filter (CVSS 6.5)
- [CVE-2023-33177](https://cve.now/CVE-2023-33177.md): Xibo CMS vulnerable to Remote Code Execution through Zip Slip (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/xibosignage
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.