{"@context":"https://openvex.dev/ns/v0.2.0","@id":"https://database.harborguard.co/cve/CVE-2026-42558/vex.json","author":"HarborGuard Database","role":"Document Creator","timestamp":"2026-06-11T12:45:36.280Z","version":1,"tooling":"HarborGuard Database (https://database.harborguard.co)","statements":[{"vulnerability":{"name":"CVE-2026-42558","@id":"https://www.cve.org/CVERecord?id=CVE-2026-42558","description":"Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.2, a vulnerability chain consisting of Stored XSS and Iframe Sandbox escape in the Xibo CMS allows users with DataSet permissions to use the Data Connector functionality to craft messages which escape the sandbox and facilitate XSS. Exploitation of the vulnerability is possible on behalf of an authorized user who has both of the following privileges, which are no"},"products":[{"@id":"cpe:2.3:a:xibosignage:xibo-cms:\\<_4.4.2:*:*:*:*:*:*:*","identifiers":{"cpe23":"cpe:2.3:a:xibosignage:xibo-cms:\\<_4.4.2:*:*:*:*:*:*:*"}}],"status":"affected","action_statement":"No fixed version is published yet; monitor the upstream advisory.","timestamp":"2026-06-11T12:45:36.280Z"}]}