Advisories · Technology
xibosignage xibo-cms.
Every CVE that names xibosignage xibo-cms among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.4 Medium
Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure
- xibosignage xibo-cms
- Broken access control
- CVSS 4.3 Medium
Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices
- xibosignage xibo-cms
- Broken access control
- CVSS 6.5 Medium
Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments
- xibosignage xibo-cms
- Broken access control
- CVSS 6.5 Medium
Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export
- xibosignage xibo-cms
- Broken access control
- CVSS 7.1 High
Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion
- xibosignage xibo-cms
- Broken access control
- CVSS 4.3 Medium
Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence
- xibosignage xibo-cms
- Broken access control
- CVSS 7.6 High
Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet
- xibosignage xibo-cms
- Cross-site scripting (XSS)
- CWE-116
- CVSS 7.7 High
Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality
- xibosignage xibo-cms
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization
- xibosignage xibo-cms
- Broken access control
- CVSS 4.9 Medium
Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality
- xibosignage xibo-cms
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login
- xibosignage xibo-cms
- Cross-site scripting (XSS)
- CVSS 7.6 High
Xibo CMS API has SQL Injection via DataSet Filter Parameter
- xibosignage xibo-cms
- SQL injection
- CWE-184
- CVSS 7.2 High
Xibo CMS: Remote Code Execution through module templates
- xibosignage xibo-cms
- Code injection
- CVSS 3.5 Low
Xibo CMS XSS vulnerability using DataSet HTML columns
- xibosignage xibo-cms
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS
- xibosignage xibo-cms
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Sensitive Information Disclosure abusing SQL Injection in Xibo CMS proof of play report
- xibosignage xibo-cms
- SQL injection
- CVSS 6.5 Medium
Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula
- xibosignage xibo-cms
- SQL injection
- CVSS 8.1 High
Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import
- xibosignage xibo-cms
- SQL injection
- CVSS 4.9 Medium
Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter
- xibosignage xibo-cms
- SQL injection
- CVSS 8.8 High
Session Hijacking via XSS attack in header and session grid in Xibo CMS
- xibosignage xibo-cms
- Cross-site scripting (XSS)
- Other injection
- CVSS 7.2 High
Session Hijacking via token exposure on the session page in Xibo CMS
- xibosignage xibo-cms
- Information disclosure
- CVSS 4.3 Medium
Sensitive Information Disclosure abusing Stack Trace in Xibo CMS
- xibosignage xibo-cms
- Information disclosure
- CVSS 6.5 Medium
Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display map
- xibosignage xibo-cms
- SQL injection
- CVSS 6.5 Medium
Sensitive Information Disclosure abusing SQL Injection in Xibo CMS nameFilter
- xibosignage xibo-cms
- SQL injection
- CVSS 6.5 Medium
Sensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filter
- xibosignage xibo-cms
- SQL injection
- CVSS 8.8 High
Xibo CMS vulnerable to Remote Code Execution through Zip Slip
- xibosignage xibo-cms
- Path traversal