SQL Injection in Xibosignage Xibo-cms
CVE-2026-31952
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Versions 1.7 through 4.4.0 have an SQL injection vulnerability in the API routes inside the CMS responsible for Filte…
Vulnerability class: SQL Injection
EPSS: 0.001 (18.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L.
Affected products
- Xibosignage Xibo-cms — versions >= 1.7, < 4.4.1
Weakness classification (CWE)
References
- https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-rq92-f6fv-3629 (x_refsource_CONFIRM)
- https://github.com/dasgarner/xibo-cms/commit/b8d25fe6cb0232b645c3850afdc2499b0e46c1e6 (x_refsource_MISC)
- https://github.com/xibosignage/xibo-cms/commit/87e0a26b0c06e349561a6becdc00f3bb01259736 (x_refsource_MISC)
- https://github.com/xibosignage/xibo-cms/commit/ed213cb4f42d4f50cf8012e01e95bb70127fc6a4 (x_refsource_MISC)
- https://github.com/xibosignage/xibo-cms/releases/tag/4.4.1 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-31952?
- CVE-2026-31952 is a high-severity vulnerability in Xibosignage Xibo-cms, classified under SQL Injection. CVSS score: 7.6/10. Published 2026-04-24.
- How severe is CVE-2026-31952?
- High severity. CVSS v3 base score is 7.6 out of 10.