# Xibo CMS has 2 cross-site scripting vulnerabilities, including stored XSS in v4.1.2

- Date: 2025-10-10
- Location: Global
- Type: Vulnerability
- Sector: Vendor
- CVE: CVE-2025-41088, CVE-2025-41089
- Products: [Xibo](https://signagelist.org/products/xibo/)

NVD published 2 vulnerabilities in Xibo CMS, covering cross-site scripting. One is stored XSS in Xibo CMS v4.1.2, caused by a lack of proper validation of user input.

## Sources

- [CVE-2025-41088](https://nvd.nist.gov/vuln/detail/CVE-2025-41088) (NIST NVD)
- [CVE-2025-41089](https://nvd.nist.gov/vuln/detail/CVE-2025-41089) (NIST NVD)
- [https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-xibo-cms](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-xibo-cms)

Page: https://signagelist.org/incidents/2025-10-xibo-cms-has-2-cross-site-scripting/