The flaw is an SQL injection in the API route that processes dataset filters (CWE‑89) and involves arbitrary string manipulation (CWE‑184). An authenticated user who holds either the Access to DataSet Feature or the Access to the Layout Feature privilege can supply a crafted filter value that allows the attacker to read or modify arbitrary records in the Xibo database. This capability can be used to exfiltrate sensitive information or tamper with content displayed by the system.

The vulnerability exists in the Xibo CMS product from the vendor Xibosignage. Versions 1.7 through 4.4.0 are affected. The issue is fixed in release 4.4.1; earlier unsupported releases such as 3.3, 2.3 and 1.8 have patch releases available.

The CVSS score of 7.6 indicates a severe impact, while the EPSS score of less than 1% suggests that exploit attempts are unlikely to occur at present. The vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated and possess the appropriate privileges to target the system, typically through the web API filtering endpoint. If such access is present, the exploit can be carried out without additional privileges or external exposure.