CVE-2026-31953

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31953", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T15:10:10.657Z", "datePublished": "2026-04-24T00:08:21.548Z", "dateUpdated": "2026-04-24T18:18:24.562Z"}, "containers": {"cna": {"title": "Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-85w9-c833-q4w2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-85w9-c833-q4w2"}, {"name": "https://github.com/xibosignage/xibo-cms/releases/tag/4.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/xibosignage/xibo-cms/releases/tag/4.4.1"}], "affected": [{"vendor": "xibosignage", "product": "xibo-cms", "versions": [{"version": "< 4.4.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T00:08:21.548Z"}, "descriptions": [{"lang": "en", "value": "Xibo is an open source digital signage platform with a web content management system and Windows display player software. A stored Cross-Site Scripting (XSS) vulnerability in versions prior to 4.4.1 allows an authenticated user with notification creation permissions to inject arbitrary JavaScript into the notification body. When the notification is set as an \"interrupt,\" the payload executes automatically in the browser of any targeted user upon login, requiring zero user interaction. Exploitation of the vulnerability is possible on behalf of an authorized user who has both of the following privileges, which are not granted to non-admins as standard: Access to the Notification Centre to view past notifications, and include \"Add Notification\" button to allow for the creation of new notifications. Users should upgrade to version 4.4.1 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust."}], "source": {"advisory": "GHSA-85w9-c833-q4w2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-24T17:06:13.418352Z", "id": "CVE-2026-31953", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T18:18:24.562Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31953", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-24T17:06:13.418352Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T17:06:17.410Z"}}], "cna": {"title": "Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login", "source": {"advisory": "GHSA-85w9-c833-q4w2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "xibosignage", "product": "xibo-cms", "versions": [{"status": "affected", "version": "< 4.4.1"}]}], "references": [{"url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-85w9-c833-q4w2", "name": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-85w9-c833-q4w2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/xibosignage/xibo-cms/releases/tag/4.4.1", "name": "https://github.com/xibosignage/xibo-cms/releases/tag/4.4.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Xibo is an open source digital signage platform with a web content management system and Windows display player software. A stored Cross-Site Scripting (XSS) vulnerability in versions prior to 4.4.1 allows an authenticated user with notification creation permissions to inject arbitrary JavaScript into the notification body. When the notification is set as an \"interrupt,\" the payload executes automatically in the browser of any targeted user upon login, requiring zero user interaction. Exploitation of the vulnerability is possible on behalf of an authorized user who has both of the following privileges, which are not granted to non-admins as standard: Access to the Notification Centre to view past notifications, and include \"Add Notification\" button to allow for the creation of new notifications. Users should upgrade to version 4.4.1 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T00:08:21.548Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31953", "state": "PUBLISHED", "dateUpdated": "2026-04-24T18:18:24.562Z", "dateReserved": "2026-03-10T15:10:10.657Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-24T00:08:21.548Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "xibo-cms", "vendor": "xibosignage", "versions": [{"status": "affected", "version": "< 4.4.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:xibosignage:xibo:*:*:*:*:*:*:*:*", "matchCriteriaId": "57F53EFF-4DF3-46B8-B538-D4D852953280", "versionEndExcluding": "4.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Xibo is an open source digital signage platform with a web content management system and Windows display player software. A stored Cross-Site Scripting (XSS) vulnerability in versions prior to 4.4.1 allows an authenticated user with notification creation permissions to inject arbitrary JavaScript into the notification body. When the notification is set as an \"interrupt,\" the payload executes automatically in the browser of any targeted user upon login, requiring zero user interaction. Exploitation of the vulnerability is possible on behalf of an authorized user who has both of the following privileges, which are not granted to non-admins as standard: Access to the Notification Centre to view past notifications, and include \"Add Notification\" button to allow for the creation of new notifications. Users should upgrade to version 4.4.1 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust."}, {"lang": "es", "value": "Xibo es una plataforma de se\u00f1alizaci\u00f3n digital de c\u00f3digo abierto con un sistema de gesti\u00f3n de contenido web y software de reproductor de pantalla para Windows. Una vulnerabilidad de cross-site scripting (XSS) almacenado en versiones anteriores a la 4.4.1 permite a un usuario autenticado con permisos de creaci\u00f3n de notificaciones inyectar JavaScript arbitrario en el cuerpo de la notificaci\u00f3n. Cuando la notificaci\u00f3n se configura como una \u2019interrupci\u00f3n\u2019, la carga \u00fatil se ejecuta autom\u00e1ticamente en el navegador de cualquier usuario objetivo al iniciar sesi\u00f3n, sin requerir interacci\u00f3n del usuario. La explotaci\u00f3n de la vulnerabilidad es posible en nombre de un usuario autorizado que tenga ambos de los siguientes privilegios, que no se otorgan a los no administradores de forma est\u00e1ndar: Acceso al Centro de Notificaciones para ver notificaciones pasadas, e incluir el bot\u00f3n \u2019A\u00f1adir Notificaci\u00f3n\u2019 para permitir la creaci\u00f3n de nuevas notificaciones. Los usuarios deben actualizar a la versi\u00f3n 4.4.1 que corrige este problema. La actualizaci\u00f3n a una versi\u00f3n corregida es necesaria para remediarlo. Los usuarios que no puedan actualizar deben revocar dichos privilegios a los usuarios en los que no conf\u00eden."}], "id": "CVE-2026-31953", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31953", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-24T17:06:13.418352Z", "version": "2.0.3"}}]}, "published": "2026-04-24T01:16:11.000", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/xibosignage/xibo-cms/releases/tag/4.4.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-85w9-c833-q4w2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.4.1)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "xibo-cms", "source": "cna", "vendor": "xibosignage"}, "product": "xibo", "vendor": "xibosignage"}], "analysis": {"en": {"generated_at": "2026-04-28T14:29:28.456900+00:00", "value": {"mitigation_remediation": ["Upgrade Xibo CMS to version 4.4.1 or later to apply the vendor patch.", "Revoke notification centre view and add\u2011notification privileges from users who do not need them.", "If an upgrade is pending, delete or disable any existing interrupt notifications that may contain malicious content and prevent the creation of new notifications until the fix is applied."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting with zero\u2011click execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Xibo CMS platform provided by xibosignage. Any installation running a version older than 4.4.1 is susceptible. The change introduces a fix in release 4.4.1; all earlier releases remain vulnerable.", "description_and_impact": "A stored Cross\u2011Site Scripting flaw exists in Xibo CMS versions prior to 4.4.1. An authenticated user who can create notifications can inject arbitrary JavaScript into the notification body. When the notification is marked as \"interrupt,\" the payload automatically runs in the browser of any user that logs in, without requiring any additional action from that user. This weakness is described by CWE\u201179.", "risk_and_exploitability": "The CVSS v3.1 score is 6.4, indicating a medium threat level. The EPSS score of less than 1% suggests that exploitation is rare, and the vulnerability is not listed in CISA\u2019s KEV catalog. However, the exploit requires an authenticated account with notification\u2011creation privileges, a role normally reserved for administrators. Once executed, the JavaScript runs within the victim\u2019s browser context during login, which can be used by an attacker to perform malicious client\u2011side actions."}}}}, "created": "2026-04-28T04:30:20.928902+00:00", "updated": "2026-04-28T14:30:33.773072+00:00", "vendors": ["xibosignage", "xibosignage$PRODUCT$xibo"]}