CVE-2025-62369
- EPSS 0.41%
- Veröffentlicht 04.11.2025 21:18:38
- Zuletzt bearbeitet 08.12.2025 13:30:12
Xibo is an open source digital signage platform with a web content management system (CMS). Versions 4.3.0 and below contain a Remote Code Execution vulnerability in the CMS Developer menu's Module Templating functionality, allowing authenticated use...
CVE-2024-43413
- EPSS 0.41%
- Veröffentlicht 03.09.2024 19:15:14
- Zuletzt bearbeitet 12.09.2024 20:18:46
Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. Users ca...
CVE-2024-43412
- EPSS 0.61%
- Veröffentlicht 03.09.2024 17:15:14
- Zuletzt bearbeitet 12.09.2024 20:20:56
Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute arbitrary JavaScript via the file preview function...
CVE-2024-41944
- EPSS 0.15%
- Veröffentlicht 30.07.2024 17:15:13
- Zuletzt bearbeitet 21.11.2024 09:33:19
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `report/data/proofofplayReport` API route inside the CMS. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database ...
CVE-2024-41804
- EPSS 0.4%
- Veröffentlicht 30.07.2024 16:15:04
- Zuletzt bearbeitet 21.11.2024 09:33:06
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Adding/Editing DataSet Column Formulas. This allows an authenticated user to to obtain and modify arbitrary data ...
CVE-2024-41803
- EPSS 0.39%
- Veröffentlicht 30.07.2024 16:15:04
- Zuletzt bearbeitet 21.11.2024 09:33:06
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain arbitrary data from the Xibo database by inje...
CVE-2024-41802
- EPSS 0.5%
- Veröffentlicht 30.07.2024 16:15:04
- Zuletzt bearbeitet 21.11.2024 09:33:06
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo datab...
CVE-2024-29022
- EPSS 0.12%
- Veröffentlicht 12.04.2024 21:15:11
- Zuletzt bearbeitet 21.11.2024 09:07:23
Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These heade...
CVE-2024-29023
- EPSS 0.11%
- Veröffentlicht 12.04.2024 21:15:11
- Zuletzt bearbeitet 21.11.2024 09:07:23
Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated a...
CVE-2023-33181
- EPSS 0.24%
- Veröffentlicht 30.05.2023 21:15:09
- Zuletzt bearbeitet 21.11.2024 08:05:03
Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that...