Login Request a demo
XI
Vendor
Xibosignage
2 products with CVEs on record
34
CVEs
0
On KEV
5
New 30D
Products
XI
xibo-cms
xibosignage
8.1
15 CVEs0 on KEV5 new
XI
Xibo
Xibosignage
8.8
19 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-50542
New
XI
xibo-cms
xibosignage
5.4–Oct 28Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure
CVE-2026-50543
New
XI
xibo-cms
xibosignage
4.3–Oct 28Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices
CVE-2026-50539
New
XI
xibo-cms
xibosignage
6.5–Oct 28Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments
CVE-2026-50541
New
XI
xibo-cms
xibosignage
6.5–Oct 28Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export
CVE-2026-52729
New
XI
xibo-cms
xibosignage
7.1–Oct 28Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion
CVE-2026-52730
XI
xibo-cms
xibosignage
4.3
0%
Aug 31Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence
CVE-2026-42558
XI
xibo-cms
xibosignage
7.6
0%
Jun 10Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet
CVE-2026-42141
XI
xibo-cms
xibosignage
7.7
0%
May 12Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality
CVE-2026-31956
XI
xibo-cms
xibosignage
4.3
0%
Apr 24Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization
CVE-2026-31955
XI
xibo-cms
xibosignage
4.9
0%
Apr 24Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality
CVE-2026-31953
XI
xibo-cms
xibosignage
5.4
0%
Apr 24Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login
CVE-2026-31952
XI
xibo-cms
xibosignage
8.1
0%
Apr 24Xibo CMS API has SQL Injection via DataSet Filter Parameter
CVE-2025-62369
XI
xibo-cms
xibosignage
7.2
1%
Nov 4Xibo CMS: Remote Code Execution through module templates
CVE-2024-43413
XI
xibo-cms
xibosignage
4.8
0%
Sep 3Xibo CMS XSS vulnerability using DataSet HTML columns
CVE-2024-43412
XI
xibo-cms
xibosignage
5.4
0%
Sep 3Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS
CVE-2024-41804
XI
Xibo
Xibosignage
6.5
0%
Jul 30Xibo is a content management system (CMS)
CVE-2024-41803
XI
Xibo
Xibosignage
4.9
0%
Jul 30Xibo is a content management system (CMS)
CVE-2024-41802
XI
Xibo
Xibosignage
8.1
0%
Jul 30Xibo is a content management system (CMS)
CVE-2023-33181
XI
Xibo
Xibosignage
5.3
1%
May 30Xibo is a content management system (CMS)
CVE-2023-33180
XI
Xibo
Xibosignage
6.5
1%
May 30Xibo is a content management system (CMS)
CVE-2023-33179
XI
Xibo
Xibosignage
6.5
1%
May 30Xibo is a content management system (CMS)
CVE-2023-33178
XI
Xibo
Xibosignage
6.5
1%
May 30Xibo is a content management system (CMS)
CVE-2023-33177
XI
Xibo
Xibosignage
8.8
7%
May 30Xibo is a content management system (CMS)
CVE-2013-4889
XI
Xibo
Xibosignage
–
1%
Jan 29Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authentication of administrators for…
CVE-2013-4888
XI
Xibo
Xibosignage
–
1%
Jan 29Cross-site scripting (XSS) vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the…
CVE-2013-4887
XI
Xibo
Xibosignage
–
1%
Jan 29SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to execute arbitrary SQL commands via the displayid parameter
CVE-2013-5979
XI
Xibo
Xibosignage
–
18%
Oct 2Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary files via a