XSS in Xibo Signage Cms
CVE-2025-41089
Reflected Cross-Site Scripting (XSS) in Xibo CMS v4.1.2 from Xibo Signage, due to a lack of proper validation of user input. To exploit the vulnerability, the attacker must create a template in the 'Templates' section, then add an element that has the 'Configuration Name' field, such as the 'Clock' widget. Next, modify the 'Configuration Name' field in the left-hand section.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (19.8th percentile) — read the EPSS interpretation.
Affected products
- Xibo Signage Cms — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-41089?
- CVE-2025-41089 is a vulnerability in Xibo Signage Cms, classified under Cross-site Scripting. Published 2025-10-10.
- Is CVE-2025-41089 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.