Xibosignage

Vulnerabilities related to Xibosignage 11

• Medium 5.4 Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /layout/status/{id} allow an authenticated user with any privileges to view the status and metadata of any layout, includ... CVE-2026-50542 00:34
• Medium 4.3 Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing authorization on POST /displaygroup/criteria/{displayGroupId} allows an authenticated user to send criteria updates to any display via XMR. These crit... CVE-2026-50543 00:32
• Medium 6.5 Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on /notification/export/{id} allows an authenticated user to download attachments from any notification, including notificati... CVE-2026-50539 00:31
• Medium 6.5 Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /dataset/export/csv/{id} allow an authenticated user to export data from any dataset, including datasets created by adminis... CVE-2026-50541 Oct 28, 22:25
• High 7.1 Xiboの脆弱性、認証済みユーザーがレイアウトの操作を改ざん・削除できる Xibo CMSの4.4.3より前のバージョンには、レイアウトのアクションを変更・削除できる脆弱性があります。ログイン済みの一般ユーザーでも、作成済みの全レイアウトに対する編集・削除の権限があれば悪用できるとされています。修正版の4.4.3へ更新してください。 CVE-2026-52729 Oct 28, 22:23
• Medium 4.3 Vulnerability in Xibo CVE-2026-31956 Apr 24, 09:16
• Medium 4.9 SSRF (Server-Side Request Forgery) in Remote DataSet Functionality SSRF in Remote DataSet Functionality (CVE-2026-31955). Confidential information can be exposed externally. CVE-2026-31955 Apr 24, 09:14
• Medium 6.4 Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login Cross-site scripting reported (CVE-2026-31953). Risk of unauthorized operations or information disclosure. CVE-2026-31953 Apr 24, 09:08
• High 7.6 Vulnerability in Xibo CVE-2026-31952 Apr 24, 09:05
• High 7.2 Code Injection in Xibo CVE-2025-62369 Nov 5, 2025
• Medium 4.3 Vulnerability in Xibo CVE-2023-33181 May 31, 2023