CVE-2024-41803

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain arbitrary data from the Xibo database by injecting specially crafted values in to the API for viewing DataSet data. Users should upgrade to version 3.3.12 or 4.0.14 which fix this issue.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jul 30, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-418046.5Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Add CVE-2024-418056.1Tracks, a Getting Things Done (GTD) web application, is vulnerable to reflected cross-site scripting in versions prior to 2.7.1. Reflected c CVE-2024-418065.3The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts i CVE-2024-418085.4The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log.CVE-2024-418096.1OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, OpenObserve contains a cross-si CVE-2024-41818.8A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework fro CVE-2024-418106.1Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains a CVE-2024-418113.9ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, suscep CVE-2024-418127.5txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Prior to version 1.7.0, a Ser CVE-2024-418137.5txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Starting in version 1.4.0 and CVE-2024-418157.0Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/CVE-2024-418165.4Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[co