GI
Product
gibbon
20
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 6Medium 10Low 1
Watch
Add gibbon to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-24724 | 9.8 | Apr 3 | Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig… Affected: through 26.0.00 |
| CVE-2023-45878 | 9.8 | Nov 14 | GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication Affected: through 25.0.01 |
| CVE-2023-34598 | 9.8 | Jun 29 | Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's… Affected: 25.0.00 |
| CVE-2026-8208 | 8.9 | May 9 | Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing interpretation of a user… Affected: before 30.0.01 |
| CVE-2025-26211 | 8.8 | May 27 | Gibbon before 29.0.00 allows CSRF Affected: before 29.0.00 |
| CVE-2024-24725 | 8.8 | Mar 23 | Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the… Affected: through 26.0.00 |
| CVE-2022-27305 | 8.8 | May 25 | Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation Affected: before 23.0.02 |
| CVE-2023-45880 | 7.2 | Nov 14 | GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder Affected: through 25.0.00 |
| CVE-2026-8207 | 7.0 | May 9 | Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing… Affected: before 30.0.01 |
| CVE-2026-8209 | 6.9 | May 9 | Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction… Affected: before 30.0.01 |
| CVE-2024-34831 | 6.1 | Sep 10 | cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter in the… Affected: 26.0.00 |
| CVE-2023-45881 | 6.1 | Nov 14 | GibbonEdu Gibbon through version 25.0.0 allows /modules/Planner/resources_addQuick_ajaxProcess.php file upload with resultant XSS Affected: through 25.0.00 |
| CVE-2023-34599 | 6.1 | Jun 29 | Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code Affected: 25.0.00 |
| CVE-2021-40492 | 6.1 | Sep 3 | A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaScript (gibbonCourseClassID,… Affected: 22.0.00 |
| CVE-2023-45879 | 5.4 | Nov 14 | GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager component Affected: through 25.0.00 |
| CVE-2022-23871 | 5.4 | Feb 3 | Multiple cross-site scripting (XSS) vulnerabilities in the component outcomes_addProcess.php of Gibbon CMS v22.0.01 allow attackers to execute arbitrary web scripts or HTML via a… Affected: 22.0.01 |
| CVE-2021-40214 | 5.4 | Sep 13 | Gibbon v22.0.00 suffers from a stored XSS vulnerability within the wall messages component Affected: 22.0.00 |
| CVE-2026-97864 | 5.3 | Sep 25 | GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication Affected: 30.0.01 |
| CVE-2022-22868 | 4.8 | Jan 28 | Gibbon CMS v22.0.01 was discovered to contain a cross-site scripting (XSS) vulnerability, that allows attackers to inject arbitrary script via name parameters Affected: 22.0.01 |
| CVE-2024-51337 | 3.5 | Nov 21 | Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive information via the email parameter found in… Affected: before 27.0.01 |
Showing 20