XI
Product
xibo-cms
15
CVEs
0
On KEV
8.1
Max CVSS
5
New 30D
Severity mix
Critical 0High 5Medium 10Low 0
Watch
Add xibo-cms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-50539 New | 6.5 | Oct 28 | Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments Affected: < 4.4.3 |
| CVE-2026-50541 New | 6.5 | Oct 28 | Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export Affected: < 4.4.3 |
| CVE-2026-50542 New | 5.4 | Oct 28 | Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure Affected: < 4.4.3 |
| CVE-2026-31953 | 5.4 | Apr 24 | Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login Affected: < 4.4.1 |
| CVE-2024-43412 | 5.4 | Sep 3 | Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS Affected: < 4.1.0 |
| CVE-2026-31955 | 4.9 | Apr 24 | Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality Affected: < 4.4.1 |
| CVE-2024-43413 | 4.8 | Sep 3 | Xibo CMS XSS vulnerability using DataSet HTML columns Affected: < 4.1.0 |
| CVE-2026-50543 New | 4.3 | Oct 28 | Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices Affected: < 4.4.3 |
| CVE-2026-52730 | 4.3 | Aug 31 | Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence Affected: < 4.4.3 |
| CVE-2026-31956 | 4.3 | Apr 24 | Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization Affected: < 4.4.1 |
Showing 10