Vulnerabilities

TI-2025-19268 CVE-2025-26211 · GHSA-5vqp-77qj-7r83

Gibbon before 29.0.00 allows CSRF.

LOW 37

Gibbon before 29.0.00 allows CSRF.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00188 Published 2025-05-27 Fixed in 29.0.00 CWE-352

TI-2024-34332 CVE-2024-51337 · GHSA-46qx-h248-6h75

Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00…

MEDIUM 50

Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive information via the email parameter found in /Gibbon/modules/User Admin/user_manage_editPr…

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.0059 Published 2024-11-21 No fix listed CWE-79

TI-2024-23116 CVE-2024-34831 · GHSA-x996-vwrq-5c5f

cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to…

MEDIUM 60

cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter in the library_manage_catalog_editProcess.php component.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00837 Published 2024-09-10 No fix listed CWE-79

TI-2024-16254 CVE-2024-24724 · GHSA-8qpg-h99j-c4j3

Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side…

HIGH 82

Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) with…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.26089 Published 2024-04-03 No fix listed CWE-1336

TI-2024-16255 CVE-2024-24725 · GHSA-6wfg-rr5q-wg74

Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization…

HIGH 72

Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.51602 Published 2024-03-23 No fix listed CWE-502

TI-2023-24633 CVE-2023-45881 · GHSA-84x9-ph3v-mc23

GibbonEdu Gibbon through version 25.0.0 allows…

MEDIUM 60

GibbonEdu Gibbon through version 25.0.0 allows /modules/Planner/resources_addQuick_ajaxProcess.php file upload with resultant XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00504 Published 2023-11-14 No fix listed CWE-79

TI-2023-24632 CVE-2023-45880 · GHSA-ffw7-j6wm-254p

GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report…

HIGH 67

GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01211 Published 2023-11-14 No fix listed CWE-22

TI-2023-24631 CVE-2023-45879 · GHSA-5rxh-5p78-8hf7

GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager component.

MEDIUM 58

GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager component.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00464 Published 2023-11-14 No fix listed CWE-79

TI-2023-24630 CVE-2023-45878 · GHSA-r526-pvv3-w6p8

GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because…

HIGH 84

GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.63365 Published 2023-11-14 No fix listed CWE-787

TI-2023-17332 CVE-2023-34599 · GHSA-gqvh-w4mq-vvrq

Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon…

MEDIUM 60

Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01868 Published 2023-06-29 No fix listed CWE-79

TI-2023-17331 CVE-2023-34598 · GHSA-mrqc-wm68-8hhj

Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to…

HIGH 82

Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.47238 Published 2023-06-29 No fix listed CWE-22

TI-2022-10403 CVE-2022-27305

Gibbon v23 does not generate a new session ID cookie after a user authenticates, making…

MEDIUM 40

Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00933 Published 2022-05-25 No fix listed CWE-384

TI-2022-07868 CVE-2022-23871 · GHSA-pwrm-wpmh-6qg9

Multiple cross-site scripting (XSS) vulnerabilities in the component…

LOW 25

Multiple cross-site scripting (XSS) vulnerabilities in the component outcomes_addProcess.php of Gibbon CMS v22.0.01 allow attackers to execute arbitrary web scripts or HTML via a crafted payload insterted into the name,…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00624 Published 2022-02-03 No fix listed CWE-79

TI-2022-07088 CVE-2022-22868 · GHSA-267q-rqmv-wvqq

Gibbon CMS v22.0.01 was discovered to contain a cross-site scripting (XSS) vulnerability…

LOW 24

Gibbon CMS v22.0.01 was discovered to contain a cross-site scripting (XSS) vulnerability, that allows attackers to inject arbitrary script via name parameters.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00857 Published 2022-01-28 No fix listed CWE-79

TI-2021-17366 CVE-2021-40214 · GHSA-j5cv-h8xh-gwcp

Gibbon v22.0.00 suffers from a stored XSS vulnerability within the wall messages component.

LOW 26

Gibbon v22.0.00 suffers from a stored XSS vulnerability within the wall messages component.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00737 Published 2021-09-13 No fix listed CWE-79

TI-2021-17539 CVE-2021-40492 · GHSA-qxgj-gjcq-4732

A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon…

LOW 32

A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaScript (gibbonCourseClassID, gibbonPersonID, subpage, currentDate, or allStudents…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02316 Published 2021-09-03 No fix listed CWE-79

Vulnerabilities

Filters