CVE-2025-41088

CVE-2025-41088: XSS Almacenado en Xibo CMS He descubierto una vulnerabilidad de Cross-Site Scripting XSS almacenado en Xibo CMS v4.1.2. Esta vulnerabilidad permite a un atacante autenticado inyectar scripts maliciosos en la aplicación debido a una validación incorrecta de la entrada proporcionada...

Xibo-CMS-Zip-Slip-RCE-Exploit-CVE-2023-33177

Exploit de Zip Slip RCE en Xibo CMS CVE-2023-33177 Este exploit demuestra una vulnerabilidad de path traversal en Xibo CMS CVE-2023-33177 que permite la ejecución remota de código mediante importaciones maliciosas de diseños. Detalles de la vulnerabilidad CVE/Aviso: CVE-2023-33177 Versiones...

-CVE-2023-33177-

Probador de la vulnerabilidad CVE-2023-33177 de Xibo CMS Herramienta automatizada de pruebas de seguridad para CVE-2023-33177 : vulnerabilidad de path traversal de tipo Zip Slip en Xibo CMS que conduce a la ejecución remota de código RCE. ⚠️ Aviso legal Esta herramienta es solo para fines...

CVE-2026-77578

CVE-2026-77578 — Lectura Arbitraria de Archivos Locales en Xibo CMS Descripción General CVE-2026-77578 es una vulnerabilidad de Lectura Arbitraria de Archivos Locales autenticada en Xibo CMS. Un usuario autenticado con privilegios de Administrador o acceso a Plantillas de Módulo puede importar un...

CVE-2025-62369

CVE-2025-62369 PoC Este script explota CVE-2025-62369 en Xibo CMS para ejecutar un comando de reverse shell. Autor Nombre: Cristian Branet GitHub: cristibtz Uso 1. Iniciar un listener root@kitploit: nc -lvnp 2. Ejecutar el exploit root@kitploit: python3 exploit.py -u "http://:" -s "" -i -p : IP...

CVE-2026-42141-xibo-ssrf

CVE-2026-42141 - SSRF en XIBO CMS Vulnerabilidad de SSRF en Xibo CMS CVE-2026-42141 Descripción Vulnerabilidad de Server-Side Request Forgery SSRF en Xibo CMS a través de la función uploadUrl. Esta vulnerabilidad fue descubierta durante una investigación de seguridad en Xibo CMS. Impacto Un usuar...

CVE-2025-41089

CVE-2025-41089: XSS Reflejado en Xibo CMS He descubierto una vulnerabilidad de Cross-Site Scripting XSS Reflejado en Xibo CMS v4.1.2. Este problema se origina por la falta de saneamiento adecuado de la entrada proporcionada por el usuario en el campo 'Configuration Name' de ciertos widgets dentro...

CVE-2026-52730

Xibo CMS prior to version 4.4.3 contains a missing authorization vulnerability in Module::settingsForm caused by PHP operator precedence . This allows an authenticated user with the Module View feature—which is not granted to non-admins by default—to view (but not change) super admin-restricted m...

CVE-2026-52730 Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view not change super admin-restricted module settings and leak the full module entity. Exploitation of...

CVE-2026-52730 Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view not change super admin-restricted module settings and leak the full module entity. Exploitation of...

CVE-2026-42141

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery SSRF vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests fr...

CVE-2026-42141

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery SSRF vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests fr...

EUVD-2026-29701

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery SSRF vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests fr...

CVE-2026-42141 Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery SSRF vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests fr...

PT-2026-40251

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery SSRF vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests fr...

📄 Xibo CMS SSTI / Remote Code Execution

Xibo CMS versions prior to 4.3.1 suffer from an authenticated remote code execution vulnerability via server-side template injection. Exploit Title: Xibo CMS - Authenticated Remote Code Execution via SSTI Date: 2025-11-04 Exploit Author: Cristian Branet Vendor Homepage: https://xibosignage.com/...

Exploit for CVE-2026-42141

CVE-2026-42141 - xibo CMS SSRF SSRF vulnerability in Xibo CMS...

Xibo CMS 4.3.0 - RCE via SSTI

Exploit Title: Xibo CMS - Authenticated Remote Code Execution via SSTI Date: 2025-11-04 Exploit Author: Cristian Branet Vendor Homepage: https://xibosignage.com/ Software Link: https://github.com/xibosignage/xibo-cms/ Version: 4.3.1 Tested on: Linux Ubuntu 22.04 CVE : CVE-2025-62639 Article:...

CVE-2026-31955

Xibo is an open source digital signage platform with a web content management system and Windows display player software. An authenticated Server-Side Request Forgery SSRF vulnerability in versions prior to 4.4.1 allows users with DataSet permissions to make arbitrary HTTP requests from the CMS...

CVE-2026-31952

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Versions 1.7 through 4.4.0 have an SQL injection vulnerability in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to...