xibosignage vulnerabilities

CVEs per yearBy the year they were published

1. 20235
2. 20248
3. 20251
4. 202612

Newest CVEs

• CVE-2026-50542

  Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure

  xibosignage · xibo-cms

  Medium5.4
• CVE-2026-50543

  Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices

  xibosignage · xibo-cms

  Medium4.3
• CVE-2026-50539

  Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments

  xibosignage · xibo-cms

  Medium6.5
• CVE-2026-50541

  Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export

  xibosignage · xibo-cms

  Medium6.5
• CVE-2026-52729

  Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion

  xibosignage · xibo-cms

  High7.1
• CVE-2026-52730

  Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence

  xibosignage · xibo-cms

  Medium4.3
• CVE-2026-42558

  Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet

  xibosignage · xibo-cms

  High7.6
• CVE-2026-42141

  Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality

  xibosignage · xibo-cms

  High7.7
• CVE-2026-31956

  Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization

  xibosignage · xibo-cms

  Medium4.3
• CVE-2026-31955

  Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality

  xibosignage · xibo-cms

  Medium4.9