Stored Cross-Site Scripting Vulnerability in Xibo Signage's Management System

CVE-2025-41088

What is CVE-2025-41088?

Xibo Signage's Xibo CMS v4.1.2 is susceptible to a stored cross-site scripting vulnerability due to inadequate validation of user inputs. Attackers can exploit this weakness by creating a malicious template in the 'Templates' section, subsequently adding a text element in the 'Global Elements' section, and inserting harmful scripts into the 'Text' field. This allows malicious payloads to be executed in the context of users accessing the affected CMS, potentially leading to data theft, session hijacking, or unauthorized actions.

References