CVE-2026-42558

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.2, a vulnerability chain consisting of Stored XSS and Iframe Sandbox escape in the Xibo CMS allows users with DataSet permissions to use the Data Connector functionality to craft messages which escape the sandbox and facilitate XSS. Exploitation of the vulnerability is possible on behalf of an authorized user who has both of the following privileges, which are not granted to non-admins as standard: Include "Add DataSet" button to allow for additional DataSets to be created independently to Layouts Users should upgrade to version 4.4.2 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust.

• CWE-79
• CWE-116
• CWE-346

• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-6389-j56c-9fww

Published

Jun 10, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42552Flight is an extensible micro-framework for PHP. Prior to 3.…7.5
• CVE-2026-42553Cinny is a Matrix client. Prior to 4.10.3, A remote authenti…7.1
• CVE-2026-42554Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0,…6.1
• CVE-2026-42555Valtimo is an open-source business process automation platfo…9.1
• CVE-2026-42556Postiz is an AI social media scheduling tool. From version 2…9
• CVE-2026-42557jupyterlab is an extensible environment for interactive and …9.6
• CVE-2026-42559RMCP is an official Rust SDK for the Model Context Protocol.…8.8
• CVE-2026-4256Improper neutralization of special elements used in an LDAP …8.2
• CVE-2026-42560auth provides authentication via oauth2, direct and email. F…9.1
• CVE-2026-42561Python-Multipart is a streaming multipart parser for Python.…7.5
• CVE-2026-42562Plainpad is a self hosted note taking app. Prior to version …8.3
• CVE-2026-42563Dulwich is a pure-Python implementation of the Git file form…7.7