Vulnerability record · CVE-2024-43413 · published 3 September 2024

CVE-2024-43413: Xibosignage xibo cross-site scripting vulnerability

Xibosignage · Xibo

Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. Users can design a DataSet with a HTML column which contains JavaScript, which is intended functionality. The JavaScript gets executed on the Data Entry page and in any Layouts which reference it. This behavior has been changed in 4.1.0 to show HTML/CSS/JS as code on the Data Entry page. There are no workarounds for this issue.

4.8 CVSS 3.1 Medium EPSS 0.28% · top 81.3% CWE-79 · Cross-site scripting

4.8CVSS 3.1 base score

0.28%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Xibo Xibosignage

References

Link	Tags
https://github.com/xibosignage/xibo-cms/commit/009527855d8bfd0ffb95f5c88ed72b7b5bdebfa1	Patch
https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-pfxp-vxh7-2h9f	Vendor Advisory

Track CVE-2024-43413 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2023-33177Xibosignage xibo path traversal vulnerabilityXibo is a content management system (CMS). A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be uploaded…EPSS 7.0%30 May 2023 8.1CVE-2026-31952Xibosignage xibo sql injection vulnerabilityXibo is an open source digital signage platform with a web content management system and Windows display player software. Versions 1.7 through 4.4.0 …EPSS 0.40%24 Apr 2026 8.1CVE-2024-41802Xibosignage xibo sql injection vulnerabilityXibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering D…EPSS 0.46%30 Jul 2024 7.5CVE-2013-4887Xibosignage xibo sql injection vulnerabilitySQL injection vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to execute arbitrary SQL commands via the displayid pa…EPSS 1.2%29 Jan 2014 7.2CVE-2025-62369Xibosignage xibo code injection vulnerabilityXibo is an open source digital signage platform with a web content management system (CMS). Versions 4.3.0 and below contain a Remote Code Execution …EPSS 0.96%4 Nov 2025 6.8CVE-2013-4889Xibosignage xibo cross-site request forgery vulnerabilityMultiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authentica…EPSS 0.85%29 Jan 2014 6.5CVE-2024-41804Xibosignage xibo sql injection vulnerabilityXibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Adding/Editi…EPSS 0.43%30 Jul 2024 6.5CVE-2023-33179Xibosignage xibo sql injection vulnerabilityXibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.5 in the …EPSS 0.62%30 May 2023

Source: NIST National Vulnerability Database (record CVE-2024-43413), CISA KEV, FIRST EPSS (scores of 2026-10-10). This page is refreshed as NVD updates the record.