228 matches found
CVE-2023-33179 Sensitive Information Disclosure abusing SQL Injection in Xibo CMS nameFilter
Xibo is a content management system CMS. An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.5 in the nameFilter function used throughout the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafte...
CVE-2023-33178
The CVE-2023-33178 issue affects Xibo CMS and is a SQL injection vulnerability in the /dataset/data/{id} API route. An authenticated user can exfiltrate data by injecting crafted values into the filter parameter, and the case-sensitive deny-list check allowed bypasses. Affected versions: 1.4.0 up...
CVE-2023-33178 Sensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filter
Xibo is a content management system CMS. An SQL injection vulnerability was discovered in the /dataset/data/id API route inside the CMS starting in version 1.4.0 and prior to versions 2.3.17 and 3.3.5. This allows an authenticated user to exfiltrate data from the Xibo database by injecting...
CVE-2023-33178 Sensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filter
Xibo is a content management system CMS. An SQL injection vulnerability was discovered in the /dataset/data/id API route inside the CMS starting in version 1.4.0 and prior to versions 2.3.17 and 3.3.5. This allows an authenticated user to exfiltrate data from the Xibo database by injecting...
CVE-2023-33178 Sensitive Information Disclosure abusing SQL Injection in Xibo CMS dataset filter
Xibo is a content management system CMS. An SQL injection vulnerability was discovered in the /dataset/data/id API route inside the CMS starting in version 1.4.0 and prior to versions 2.3.17 and 3.3.5. This allows an authenticated user to exfiltrate data from the Xibo database by injecting...
CVE-2023-33177 Xibo CMS vulnerable to Remote Code Execution through Zip Slip
Xibo is a content management system CMS. A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be uploaded to the CMS via the layout import function by an authenticated user which would allow creation of files outside of the CMS library directory as the...
CVE-2023-33177 Xibo CMS vulnerable to Remote Code Execution through Zip Slip
Xibo is a content management system CMS. A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be uploaded to the CMS via the layout import function by an authenticated user which would allow creation of files outside of the CMS library directory as the...
CVE-2023-33177
Summary of CVE-2023-33177 (Xibo CMS) A path traversal vulnerability exists in Xibo CMS where an authenticated user can upload a specially crafted ZIP via the layout import function. This enables creation of files outside the CMS library directory as the webserver user, potentially allowing remote...
CVE-2023-33177 Xibo CMS vulnerable to Remote Code Execution through Zip Slip
Xibo is a content management system CMS. A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be uploaded to the CMS via the layout import function by an authenticated user which would allow creation of files outside of the CMS library directory as the...
PT-2023-24194 · Xibo · Xibo
Name of the Vulnerable Software and Affected Versions: Xibo versions 1.4.0 through 2.3.16 Xibo versions 2.3.17 is not affected, but versions prior to 3.3.5 are affected, so the correct range is Xibo versions 3.3.0 through 3.3.4 Description: A SQL injection issue was discovered in the...
Xibo SQL注入漏洞
Xibo is an open source content management system from Xibo Digital Signage. A security vulnerability exists in Xibo that stems from an SQL injection vulnerability that allows an authenticated user to steal data by injecting a specially crafted value into the parameter filter...
PT-2023-24195 · Xibo · Xibo
Name of the Vulnerable Software and Affected Versions: Xibo versions 3.2.0 through 3.3.4 Description: A SQL injection issue was discovered in the nameFilter function, allowing an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values for logical...
PT-2023-24198 · Xibo · Xibo
Name of the Vulnerable Software and Affected Versions: Xibo versions 3.0.0 through 3.3.4 Description: Xibo is a content management system CMS that has an issue where some API routes print a stack trace when called with missing or invalid parameters, revealing sensitive information about the...
PT-2023-24193 · Xibo · Xibo
Name of the Vulnerable Software and Affected Versions: Xibo versions prior to 2.3.17 Xibo versions prior to 3.3.5 Description: A path traversal vulnerability exists in the Xibo CMS, allowing a specially crafted zip file to be uploaded via the layout import function by an authenticated user. This...
Xibo SQL注入漏洞
Xibo is an open source content management system from Xibo Digital Signage. A security vulnerability exists in Xibo versions 3.2.0 through 3.3.2 and earlier, which stems from an SQL injection vulnerability that allows an authenticated user to steal data by injecting a specially crafted value into...
Xibo 安全漏洞
Xibo is an open source content management system from Xibo Digital Signage. A security vulnerability exists in Xibo versions prior to 3.0.0 through 3.3.5, which originates from a stack trace being printed when called with missing or invalid parameters, which can be exploited by an attacker to vie...
Xibo SQL注入漏洞
Xibo is an open source content management system from Xibo Digital Signage. A security vulnerability exists in Xibo versions prior to 3.2.0 through 3.3.5 that stems from the presence of a SQL injection vulnerability...
Xibo 路径遍历漏洞
Xibo is an open source content management system from Xibo Digital Signage. A security vulnerability exists in Xibo that stems from a path traversal vulnerability that allows an authenticated user to upload a specially crafted zip file to the CMS, which would allow a user acting as a web server t...
