Xibo CMS API has SQL Injection via DataSet Filter Parameter

Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality

Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet

Xibo CMS: Remote Code Execution through module templates

Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion

Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments

Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export

Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure

Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login

Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS

Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality

Xibo CMS XSS vulnerability using DataSet HTML columns

Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices

Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence

Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization