CVE-2024-41944

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `report/data/proofofplayReport` API route inside the CMS. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to the `sortBy` parameter. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue.

• CWE-89

• https://github.com/xibosignage/xibo-cms/commit/c60cfd8727da77b9db10297148eadd697ebec353.patch
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-v6q4-h869-gm3r
• https://xibosignage.com/blog/security-advisory-2024-07
• https://github.com/xibosignage/xibo-cms/commit/c60cfd8727da77b9db10297148eadd697ebec353.patch
• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-v6q4-h869-gm3r
• https://xibosignage.com/blog/security-advisory-2024-07

Published

Jul 30, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41939A vulnerability has been identified in SINEC NMS (All versio…8.8
• CVE-2024-4194The The Album and Image Gallery plus Lightbox plugin for Wor…7.3
• CVE-2024-41940A vulnerability has been identified in SINEC NMS (All versio…9.1
• CVE-2024-41941A vulnerability has been identified in SINEC NMS (All versio…4.3
• CVE-2024-41942JupyterHub is software that allows one to create a multi-use…7.2
• CVE-2024-41943I, Librarian is an open-source version of a PDF managing Saa…4.6
• CVE-2024-41945fuels-ts is a library for interacting with Fuel v2. The typ…3.1
• CVE-2024-41946REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a …7.5
• CVE-2024-41947XWiki Platform is a generic wiki platform offering runtime s…5.4
• CVE-2024-41948biscuit-java is the java implementation of Biscuit, an authe…5
• CVE-2024-41949biscuit-rust is the Rust implementation of Biscuit, an authe…6.4
• CVE-2024-4195Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x bef…2.7