# Xibo CMS DataSet features have SQL injection flaws, CVE-2024-41802 to CVE-2024-41804

- Date: 2024-07
- Location: Global
- Type: Vulnerability
- Sector: Other
- CVE: CVE-2024-41802, CVE-2024-41803, CVE-2024-41804, CVE-2024-41944
- Products: [Xibo](https://signagelist.org/products/xibo/)

Xibo's July 2024 advisory covered SQL injection flaws in the DataSet features of its CMS, tracked as CVE-2024-41802, CVE-2024-41803 and CVE-2024-41804. The advisory text did not confirm the exact fixed versions.

## Sources

- [Xibo security advisory 2024-07](https://xibosignage.com/blog/security-advisory-2024-07) (Xibo Signage)
- [CVE-2024-41803](https://cvefeed.io/vuln/detail/CVE-2024-41803) (cvefeed.io)
- [CVE-2024-41802](https://nvd.nist.gov/vuln/detail/CVE-2024-41802) (NIST NVD)
- [CVE-2024-41803](https://nvd.nist.gov/vuln/detail/CVE-2024-41803) (NIST NVD)
- [CVE-2024-41804](https://nvd.nist.gov/vuln/detail/CVE-2024-41804) (NIST NVD)
- [CVE-2024-41944](https://nvd.nist.gov/vuln/detail/CVE-2024-41944) (NIST NVD)
- [https://github.com/xibosignage/xibo-cms/commit/b7a5899338cd841a39702e3fcaff76aa0ffe4075](https://github.com/xibosignage/xibo-cms/commit/b7a5899338cd841a39702e3fcaff76aa0ffe4075)
- [https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-x4qm-vvhp-g7c2](https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-x4qm-vvhp-g7c2)

Page: https://signagelist.org/incidents/2024-07-xibo-cms-dataset-features-have-sql-injection/