Vulnerability · Published Oct 10, 2025 · Assigned by INCIBE
CVE-2025-41089Reflected Cross-Site Scripting (XSS) in CMS
Medium 4.8
In plain English
A medium-severity cross-site scripting in Xibo CMS from Xibo Signage. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Reflected Cross-Site Scripting (XSS) in Xibo CMS v4.1.2 from Xibo Signage, due to a lack of proper validation of user input. To exploit the vulnerability, the attacker must create a template in the 'Templates' section, then add an element that has the 'Configuration Name' field, such as the 'Clock' widget. Next, modify the 'Configuration Name' field in the left-hand section.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Xibo Signage | Xibo CMS | 0 – before 4.2.2 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N