Xibo-CMS-Zip-Slip-RCE-Exploit-CVE-2023-33177

Exploit RCE Zip Slip per Xibo CMS CVE-2023-33177 Questo exploit dimostra una vulnerabilità di path traversal in Xibo CMS CVE-2023-33177 che consente l'esecuzione remota di codice tramite importazioni di layout malevoli. Dettagli della vulnerabilità CVE/Advisory: CVE-2023-33177 Versioni affette:...

-CVE-2023-33177-

Xibo CMS CVE-2023-33177 Tester di Vulnerabilità Strumento automatizzato di test di sicurezza per CVE-2023-33177 - Vulnerabilità Zip Slip Path Traversal in Xibo CMS che porta all'esecuzione di codice remoto RCE. ⚠️ Disclaimer Questo strumento è solo per scopi educativi e di test autorizzati. Solo...

CVE-2026-77578

CVE-2026-77578 — Lettura arbitraria di file locali in Xibo CMS Panoramica CVE-2026-77578 è una vulnerabilità di lettura arbitraria di file locali autenticata in Xibo CMS. Un utente autenticato con privilegi di amministratore o accesso ai Modelli di modulo può importare un template XML appositamen...

CVE-2025-41089

CVE-2025-41089: XSS Riflesso in Xibo CMS Ho scoperto una vulnerabilità di Cross-Site Scripting XSS Riflesso in Xibo CMS v4.1.2. Il problema deriva dalla mancata corretta sanificazione dell'input fornito dall'utente nel campo 'Configuration Name' di alcuni widget all'interno dell'editor dei...

CVE-2026-42141-xibo-ssrf

CVE-2026-42141 - XIBO CMS SSRF SSRF-Schwachstelle in Xibo CMS CVE-2026-42141 Beschreibung Server-Side Request Forgery SSRF-Schwachstelle in Xibo CMS über die uploadUrl-Funktion. Diese Schwachstelle wurde während einer Sicherheitsforschung zu Xibo CMS entdeckt. Auswirkungen Ein authentifizierter...

CVE-2025-62369

CVE-2025-62369 PoC Dieses Skript nutzt CVE-2025-62369 in Xibo CMS aus, um einen Reverse-Shell-Befehl auszuführen. Autor Name: Cristian Branet GitHub: cristibtz Verwendung 1. Einen Listener starten nc -lvnp 2. Den Exploit ausführen python3 exploit.py -u "http://:" -s "" -i -p : IP des Xibo CMS...

CVE-2025-41088

CVE-2025-41088: XSS Memorizzato in Xibo CMS Ho scoperto una vulnerabilità di Cross-Site Scripting XSS Memorizzato in Xibo CMS v4.1.2. Questa vulnerabilità permette a un attaccante autenticato di iniettare script dannosi nell'applicazione a causa di una validazione impropria dell'input fornito...

CVE-2026-52730 Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view not change super admin-restricted module settings and leak the full module entity. Exploitation of...

CVE-2026-52730

Xibo CMS prior to version 4.4.3 contains a missing authorization vulnerability in Module::settingsForm caused by PHP operator precedence . This allows an authenticated user with the Module View feature—which is not granted to non-admins by default—to view (but not change) super admin-restricted m...

CVE-2026-52730 Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view not change super admin-restricted module settings and leak the full module entity. Exploitation of...

CVE-2026-52730 Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view not change super admin-restricted module settings and leak the full module entity. Exploitation of...

CVE-2026-42558: Improper Neutralization of Input During Web Page Generation

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.2, a vulnerability chain consisting of Stored XSS and Iframe Sandbox escape in the Xibo CMS allows users with DataSet permissions to use the Data Connector...

CVE-2026-42141

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery SSRF vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests fr...

CVE-2026-42141

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery SSRF vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests fr...

CVE-2026-42141 Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery SSRF vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests fr...

EUVD-2026-29701

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery SSRF vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests fr...

PT-2026-40251

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery SSRF vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests fr...

📄 Xibo CMS SSTI / Remote Code Execution

Xibo CMS versions prior to 4.3.1 suffer from an authenticated remote code execution vulnerability via server-side template injection. Exploit Title: Xibo CMS - Authenticated Remote Code Execution via SSTI Date: 2025-11-04 Exploit Author: Cristian Branet Vendor Homepage: https://xibosignage.com/...

Exploit for CVE-2026-42141

CVE-2026-42141 - xibo CMS SSRF SSRF vulnerability in Xibo CMS...

Xibo CMS 4.3.0 - RCE via SSTI

Exploit Title: Xibo CMS - Authenticated Remote Code Execution via SSTI Date: 2025-11-04 Exploit Author: Cristian Branet Vendor Homepage: https://xibosignage.com/ Software Link: https://github.com/xibosignage/xibo-cms/ Version: 4.3.1 Tested on: Linux Ubuntu 22.04 CVE : CVE-2025-62639 Article:...