Global
Xibo CMS module templating flaw allows remote code execution (CVE-2025-62369)
A code injection flaw in the Module Templating feature of Xibo CMS, reachable from the CMS Developer menu, allows remote code execution in versions up to 4.3.0. Xibo fixed it in 4.3.1, while 4.1 and 4.2 deployments were pointed to upstream patch commits instead of a version upgrade. Feedly reports a public proof-of-concept script on GitHub, which other databases do not mention.
- Type
- Vulnerability
- Sector
- Other
- Country
- Global
