Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 29

Export CSV
CVE-2023-33179

Sensitive Information Disclosure abusing SQL Injection in Xibo CMS nameFilter

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.5 in the `nameFilter` function used throughout the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values for logical operators. Users should upgrade to version 3.3.5 which fixes this issue. There are no known workarounds aside from upgrading.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Xibosignage
Products
Xibo
CVE-2023-33180

Sensitive Information Disclosure abusing SQL Injection in Xibo CMS display map

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.2 in the `/display/map` API route inside the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values in to the `bounds` parameter. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Xibosignage
Products
Xibo
CVE-2023-33178

Sensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filter

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `/dataset/data/{id}` API route inside the CMS starting in version 1.4.0 and prior to versions 2.3.17 and 3.3.5. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values in to the `filter` parameter. Values allowed in the filter parameter are checked against a deny list of commands that should not be allowed, however this checking was done in a case sensitive manor and so it is possible to bypass these checks by using unusual case combinations. Users should upgrade to version 2.3.17 or 3.3.5, which fix this issue. There are no workarounds aside from upgrading.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Xibosignage
Products
Xibo
CVE-2023-33181

Sensitive Information Disclosure abusing Stack Trace in Xibo CMS

Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Xibosignage
Products
Xibo
CVE-2024-41804

Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Adding/Editing DataSet Column Formulas. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the `formula` parameter. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Xibosignage
Products
Xibo
CVE-2024-41803

Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain arbitrary data from the Xibo database by injecting specially crafted values in to the API for viewing DataSet data. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Xibosignage
Products
Xibo
CVE-2024-41802

Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the APIs for importing JSON and importing a Layout containing DataSet data. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Xibosignage
Products
Xibo
CVE-2024-43412

Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS

Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute arbitrary JavaScript via the file preview function. Users can upload HTML/CSS/JS files into the Xibo Library via the Generic File module to be referenced on Displays and in Layouts. This is intended functionality. When previewing these resources from the Library and Layout editor they are executed in the users browser. This will be disabled in future releases, and users are encouraged to use the new developer tools in 4.1 to design their widgets which require this type of functionality. This behavior has been changed in 4.1.0 to preview previewing of generic files. There are no workarounds for this issue.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Xibosignage
Products
Xibo
CVE-2024-43413

Xibo CMS XSS vulnerability using DataSet HTML columns

Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. Users can design a DataSet with a HTML column which contains JavaScript, which is intended functionality. The JavaScript gets executed on the Data Entry page and in any Layouts which reference it. This behavior has been changed in 4.1.0 to show HTML/CSS/JS as code on the Data Entry page. There are no workarounds for this issue.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Xibosignage
Products
Xibo