# Xibo CMS April 2026 advisories include SQL injection, stored XSS, SSRF and IDOR flaws

- Date: 2026-04
- Location: Global
- Type: Vulnerability
- Sector: Other
- CVE: CVE-2026-31952, CVE-2026-31953, CVE-2026-31955, CVE-2026-31956
- Products: [Xibo](https://signagelist.org/products/xibo/)

A batch of Xibo CMS advisories published in April 2026 includes CVE-2026-31952, a SQL injection through the API DataSet filter parameter rated 7.6, and CVE-2026-31953, a stored XSS in the notification body. The batch also lists an authenticated server-side request forgery in remote DataSet functionality (CVE-2026-31955) and an IDOR in Preview and SavedReport (CVE-2026-31956). The fixed versions for these entries were not confirmed.

## Sources

- [CVE-2026-31952](https://nvd.nist.gov/vuln/detail/CVE-2026-31952) (NIST NVD)
- [CVE-2026-31953](https://nvd.nist.gov/vuln/detail/CVE-2026-31953) (NIST NVD)
- [CVE-2026-31955](https://nvd.nist.gov/vuln/detail/CVE-2026-31955) (NIST NVD)
- [CVE-2026-31956](https://nvd.nist.gov/vuln/detail/CVE-2026-31956) (NIST NVD)
- [https://github.com/dasgarner/xibo-cms/commit/b8d25fe6cb0232b645c3850afdc2499b0e46c1e6](https://github.com/dasgarner/xibo-cms/commit/b8d25fe6cb0232b645c3850afdc2499b0e46c1e6)
- [https://github.com/xibosignage/xibo-cms/commit/87e0a26b0c06e349561a6becdc00f3bb01259736](https://github.com/xibosignage/xibo-cms/commit/87e0a26b0c06e349561a6becdc00f3bb01259736)

Page: https://signagelist.org/incidents/2026-04-xibo-cms-april-2026-advisories-include-sql/