Xibo Cms
Monthly
Stored cross-site scripting in Xibo CMS prior to 4.4.2 allows authenticated users with elevated DataSet privileges to chain a Stored XSS with an iframe sandbox escape via the Data Connector functionality, executing script in another user's browser context. Scope-changed impact (S:C) with high confidentiality loss means a low-privileged-but-trusted operator can compromise an admin session viewing the affected dataset content. No public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Server-Side Request Forgery in Xibo CMS versions prior to 4.4.1 lets an authenticated user with Library upload permissions coerce the CMS server into issuing arbitrary HTTP requests to internal or external hosts. This enables internal network scanning, reaching cloud instance-metadata endpoints such as AWS IMDS, pivoting to unauthenticated internal services, and data exfiltration. No public exploit identified at time of analysis; EPSS is low (0.03%, 9th percentile) and CISA SSVC records exploitation as none.
SQL injection in Xibo CMS versions 1.7 through 4.4.0 allows authenticated users with DataSet or Layout access privileges to extract and modify arbitrary database contents via crafted API filter parameters. The vulnerability affects a widely-deployed open source digital signage platform and has been addressed in version 4.4.1, with patches retroactively provided for out-of-support versions (3.3, 2.3, 1.8) indicating vendor awareness of active deployments on legacy versions. EPSS data not available, but the low attack complexity (AC:L) and network vector (AV:N) combined with the broad version range (nearly 7 years of releases) suggest significant exposure across installations.
Missing authorization in Xibo CMS prior to 4.4.3 exposes super admin-restricted module settings and full module entity data to authenticated users holding the Module View privilege, via the Module::settingsForm endpoint. The disclosure is read-only - no configuration changes are possible - but the leak of privileged system configuration to lower-trust accounts represents a vertical privilege escalation in the confidentiality dimension. Vendor patch 4.4.3 is available; no public exploit or active exploitation has been identified.
Stored cross-site scripting in Xibo CMS prior to 4.4.2 allows authenticated users with elevated DataSet privileges to chain a Stored XSS with an iframe sandbox escape via the Data Connector functionality, executing script in another user's browser context. Scope-changed impact (S:C) with high confidentiality loss means a low-privileged-but-trusted operator can compromise an admin session viewing the affected dataset content. No public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Server-Side Request Forgery in Xibo CMS versions prior to 4.4.1 lets an authenticated user with Library upload permissions coerce the CMS server into issuing arbitrary HTTP requests to internal or external hosts. This enables internal network scanning, reaching cloud instance-metadata endpoints such as AWS IMDS, pivoting to unauthenticated internal services, and data exfiltration. No public exploit identified at time of analysis; EPSS is low (0.03%, 9th percentile) and CISA SSVC records exploitation as none.
SQL injection in Xibo CMS versions 1.7 through 4.4.0 allows authenticated users with DataSet or Layout access privileges to extract and modify arbitrary database contents via crafted API filter parameters. The vulnerability affects a widely-deployed open source digital signage platform and has been addressed in version 4.4.1, with patches retroactively provided for out-of-support versions (3.3, 2.3, 1.8) indicating vendor awareness of active deployments on legacy versions. EPSS data not available, but the low attack complexity (AC:L) and network vector (AV:N) combined with the broad version range (nearly 7 years of releases) suggest significant exposure across installations.
Missing authorization in Xibo CMS prior to 4.4.3 exposes super admin-restricted module settings and full module entity data to authenticated users holding the Module View privilege, via the Module::settingsForm endpoint. The disclosure is read-only - no configuration changes are possible - but the leak of privileged system configuration to lower-trust accounts represents a vertical privilege escalation in the confidentiality dimension. Vendor patch 4.4.3 is available; no public exploit or active exploitation has been identified.