XSS in Xibo Signage Cms
CVE-2025-41088
Stored Cross-Site Scripting (XSS) in Xibo Signage's Xibo CMS v4.1.2, due to a lack of proper validation of user input. To exploit the vulnerability, the attacker must create a template in the 'Templates' section, then add a text element in the 'Global Elements' section, and finally modify the 'Text' field in the section with the malicious payload.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (27.1th percentile) — read the EPSS interpretation.
Affected products
- Xibo Signage Cms — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-41088?
- CVE-2025-41088 is a vulnerability in Xibo Signage Cms, classified under Cross-site Scripting. Published 2025-10-10.
- Is CVE-2025-41088 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.