VendorsXibo Signagexiboall versions
Vulnerabilities

Xibo Signage Xibo

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

19CVEs
CVE-2023-33177
Xibo CMS vulnerable to Remote Code Execution through Zip Slip
Published 2023-05-30 · Modified
8.81 PoCEPSS 0.070
CVE-2024-41802
Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import
Published 2024-07-30 · Modified
8.1EPSS 0.005
CVE-2026-31952
Xibo CMS API has SQL Injection via DataSet Filter Parameter
Published 2026-04-24 · Analyzed
8.1EPSS 0.004
CVE-2013-4887
SQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to execute arbitrary SQL commands via the displayid parameter.
Published 2014-01-29 · Modified
7.5EPSS 0.012
CVE-2025-62369
Xibo CMS: Remote Code Execution through module templates
Published 2025-11-04 · Analyzed
7.2EPSS 0.009
CVE-2013-4889
Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new administrator via the AddUser action or (2) conduct cross-site scripting (XSS) attacks, as demonstrated by CVE-2013-4888.
Published 2014-01-29 · Modified
6.81 PoCEPSS 0.009
CVE-2023-33178
Sensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filter
Published 2023-05-30 · Modified
6.5EPSS 0.006
CVE-2023-33180
Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display map
Published 2023-05-30 · Modified
6.5EPSS 0.006
CVE-2023-33179
Sensitive Information Disclosure abusing SQL Injection in Xibo CMS nameFilter
Published 2023-05-30 · Modified
6.5EPSS 0.006
CVE-2024-41804
Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula
Published 2024-07-30 · Modified
6.5EPSS 0.004
CVE-2026-31953
Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login
Published 2026-04-24 · Analyzed
6.4EPSS 0.002
CVE-2024-43412
Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS
Published 2024-09-03 · Analyzed
5.4EPSS 0.003
CVE-2023-33181
Sensitive Information Disclosure abusing Stack Trace in Xibo CMS
Published 2023-05-30 · Modified
5.3EPSS 0.005
CVE-2013-5979
Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the p parameter to index.php.
Published 2013-10-02 · Modified
5.01 PoCEPSS 0.181
CVE-2026-31955
Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality
Published 2026-04-24 · Analyzed
4.9EPSS 0.005
CVE-2024-41803
Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter
Published 2024-07-30 · Modified
4.9EPSS 0.004
CVE-2024-43413
Xibo CMS XSS vulnerability using DataSet HTML columns
Published 2024-09-03 · Analyzed
4.8EPSS 0.003
CVE-2013-4888
Cross-site scripting (XSS) vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page.
Published 2014-01-29 · Modified
4.31 PoCEPSS 0.014
CVE-2026-31956
Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization
Published 2026-04-24 · Analyzed
4.3EPSS 0.003