CVE-2024-41804

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Adding/Editing DataSet Column Formulas. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the `formula` parameter. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue.

• CWE-89
• CWE-89

• https://github.com/xibosignage/xibo-cms/commit/39a2fd54b3f08831b0004aa2015bd8a753bc567f.patchPatch, Vendor Advisory
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-4pp3-4mw7-qfwrPatch, Vendor Advisory
• https://xibosignage.com/blog/security-advisory-2024-07Vendor Advisory
• https://github.com/xibosignage/xibo-cms/commit/39a2fd54b3f08831b0004aa2015bd8a753bc567f.patchPatch, Vendor Advisory
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-4pp3-4mw7-qfwrPatch, Vendor Advisory
• https://xibosignage.com/blog/security-advisory-2024-07Vendor Advisory

Published

Jul 30, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41799tgstation-server is a production scale tool for BYOND server…9.9
• CVE-2024-4180The Events Calendar WordPress plugin before 6.4.0.1 does not…9.1
• CVE-2024-41800Craft is a content management system (CMS). Craft CMS 5 allo…7.5
• CVE-2024-41801OpenProject is open source project management software. Prio…6.1
• CVE-2024-41802Xibo is a content management system (CMS). An SQL injection …8.1
• CVE-2024-41803Xibo is a content management system (CMS). An SQL injection …4.9
• CVE-2024-41805Tracks, a Getting Things Done (GTD) web application, is vuln…6.1
• CVE-2024-41806The Open edX Platform is a learning management platform. Ins…5.3
• CVE-2024-41807Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. Co…
• CVE-2024-41808The OpenObserve open-source observability platform provides …5.4
• CVE-2024-41809OpenObserve is an open-source observability platform. Starti…6.1
• CVE-2024-4181A command injection vulnerability exists in the RunGptLLM cl…8.8