CVE-2024-41803

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain arbitrary data from the Xibo database by injecting specially crafted values in to the API for viewing DataSet data. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue.

• CWE-89
• CWE-89

• https://github.com/xibosignage/xibo-cms/commit/39a2fd54b3f08831b0004aa2015bd8a753bc567f.patchPatch, Vendor Advisory
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-hpc5-mxfq-44hvPatch, Vendor Advisory
• https://xibosignage.com/blog/security-advisory-2024-07Vendor Advisory
• https://github.com/xibosignage/xibo-cms/commit/39a2fd54b3f08831b0004aa2015bd8a753bc567f.patchPatch, Vendor Advisory
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-hpc5-mxfq-44hvPatch, Vendor Advisory
• https://xibosignage.com/blog/security-advisory-2024-07Vendor Advisory

Published

Jul 30, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41798A vulnerability has been identified in SENTRON 7KM PAC3200 (…9.8
• CVE-2024-41799tgstation-server is a production scale tool for BYOND server…9.9
• CVE-2024-4180The Events Calendar WordPress plugin before 6.4.0.1 does not…9.1
• CVE-2024-41800Craft is a content management system (CMS). Craft CMS 5 allo…7.5
• CVE-2024-41801OpenProject is open source project management software. Prio…6.1
• CVE-2024-41802Xibo is a content management system (CMS). An SQL injection …8.1
• CVE-2024-41804Xibo is a content management system (CMS). An SQL injection …6.5
• CVE-2024-41805Tracks, a Getting Things Done (GTD) web application, is vuln…6.1
• CVE-2024-41806The Open edX Platform is a learning management platform. Ins…5.3
• CVE-2024-41807Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. Co…
• CVE-2024-41808The OpenObserve open-source observability platform provides …5.4
• CVE-2024-41809OpenObserve is an open-source observability platform. Starti…6.1