Xibosignage vulnerabilities
We track 9 vulnerabilities in Xibosignage products across 2 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on October 28, 2026.
Latest Xibosignage vulnerabilities
- 7.1 High severity
xibo-cms: Missing Authorization
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `PUT/DELETE /action/{id}` allow an authenticated user to modify or delete actions on any
- 7.6 High severity
xibo-cms: Improper Neutralization of Input During Web Page Generation
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.2, a vulnerability chain consisting of Stored XSS and Iframe Sandbox escape in the Xibo CMS allows users with DataSet permiss
- 7.7 High severity
xibo-cms: Server-Side Request Forgery
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability in the Xibo CMS allows users with Library upload permiss
- 8.1 High severity
xibo-cms: Improper Neutralization of Special Elements used in an SQL Command
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Versions 1.7 through 4.4.0 have an SQL injection vulnerability in the API routes inside the CMS responsible for Filtering DataSets. This a
- 7.2 High severity
xibo-cms: Improper Control of Generation of Code
Xibo is an open source digital signage platform with a web content management system (CMS). Versions 4.3.0 and below contain a Remote Code Execution vulnerability in the CMS Developer menu's Module Templating functionality, allowing authenticated users with "S
- 8.1 High severity
xibo-cms: Improper Neutralization of Special Elements used in an SQL Command
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by inj
- 7.2 High severity
xibo-cms: Exposure of Sensitive Information to an Unauthorized Actor
Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used to
- 8.8 High severity
xibo-cms: Improper Neutralization of Input During Web Page Generation
Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be
- 8.8 High severity
xibo-cms: Improper Limitation of a Pathname to a Restricted Directory
Xibo is a content management system (CMS). A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be uploaded to the CMS via the layout import function by an authenticated user which would allow creation of files outside