CVE-2024-43413

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Xibo is an open source digital signage platform with a web content management system (CMS). Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. Users can design a DataSet with a HTML column which contains JavaScript, which is intended functionality. The JavaScript gets executed on the Data Entry page and in any Layouts which reference it. This behavior has been changed in 4.1.0 to show HTML/CSS/JS as code on the Data Entry page. There are no workarounds for this issue.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 3, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-434147.5Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each team can own their slice of the graph indepCVE-2024-434159.0An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidim_awesome-module <= v0.1CVE-2024-434165.3GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can CVE-2024-434176.1GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order CVE-2024-434186.1GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order CVE-2024-43425.4The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image hotspot, iCVE-2024-434205.6Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel AtoCVE-2024-434239.8The web application for ProGauge MAGLINK LX4 CONSOLE contains an administrative-level user account with a password that cannot be changed.CVE-2024-434247.5Sharp and Toshiba Tec MFPs improperly process HTTP request headers, resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requestsCVE-2024-434258.1A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: TCVE-2024-434267.5A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeXCVE-2024-434273.7A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded f