Reflected Cross-Site Scripting Vulnerability in Xibo CMS by Xibo Signage

CVE-2025-41089

What is CVE-2025-41089?

A reflected cross-site scripting (XSS) vulnerability exists in Xibo CMS v4.1.2, allowing attackers to manipulate user input without proper validation. By creating a template in the 'Templates' section and adjusting the 'Configuration Name' field in elements like the 'Clock' widget, an attacker can execute malicious scripts in the context of a user's session. This can lead to unauthorized actions and data exposure, making it crucial for users to apply mitigations provided by the vendor.

References