Skip to content
Noroxi

GibbonEdu records

16 published records for vendor GibbonEdu. 0 of them have been exploited in the wild (listed in CISA KEV) and 1 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 6.3%
Pre-auth RCE
4
With a fix record
0%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 21
  2. 22
  3. 23
  4. 24
  5. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

16 records
  • CVE-2023-45878
    58Plan

    GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authenticati

    CriticalCVSS 9.8Proof of conceptEPSS 63%

    gibbonedu · gibbonNov 14, 2023

  • CVE-2023-34598
    53Plan

    Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the inst

    CriticalCVSS 9.8Proof of conceptEPSS 47%

    gibbonedu · gibbonJun 29, 2023

  • CVE-2024-24725
    50Plan

    Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the mod

    HighCVSS 8.8WeaponizedEPSS 51%

    gibbonedu · gibbonMar 23, 2024

  • CVE-2024-24724
    47Plan

    Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution

    CriticalCVSS 9.8Proof of conceptEPSS 26%

    gibbonedu · gibbonApr 2, 2024

  • CVE-2022-27305
    35Monitor

    Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.

    HighCVSS 8.8No exploitEPSS 0%

    gibbonedu · gibbonMay 25, 2022

  • CVE-2025-26211
    35Monitor

    Gibbon before 29.0.00 allows CSRF.

    HighCVSS 8.8No exploitEPSS 0%

    gibbonedu · gibbonMay 27, 2025

  • CVE-2023-45880
    28Monitor

    GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder.

    HighCVSS 7.2No exploitEPSS 1%

    gibbonedu · gibbonNov 14, 2023

  • CVE-2021-40492
    25Monitor

    A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaSc

    MediumCVSS 6.1Proof of conceptEPSS 2%

    gibbonedu · gibbonSep 3, 2021

  • CVE-2023-34599
    25Monitor

    Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Java

    MediumCVSS 6.1Proof of conceptEPSS 1%

    gibbonedu · gibbonJun 29, 2023

  • CVE-2024-34831
    24Monitor

    cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter in

    MediumCVSS 6.1Proof of conceptEPSS 0%

    gibbonedu · gibbonSep 10, 2024

  • CVE-2023-45881
    24Monitor

    GibbonEdu Gibbon through version 25.0.0 allows /modules/Planner/resources_addQuick_ajaxProcess.php file upload with resultant XSS.

    MediumCVSS 6.1No exploitEPSS 0%

    gibbonedu · gibbonNov 14, 2023

  • CVE-2021-40214
    21Monitor

    Gibbon v22.0.00 suffers from a stored XSS vulnerability within the wall messages component.

    MediumCVSS 5.4No exploitEPSS 0%

    gibbonedu · gibbonSep 13, 2021

  • CVE-2022-23871
    21Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in the component outcomes_addProcess.php of Gibbon CMS v22.0.01 allow attackers to execu

    MediumCVSS 5.4No exploitEPSS 0%

    gibbonedu · gibbonFeb 2, 2022

  • CVE-2023-45879
    21Monitor

    GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager component.

    MediumCVSS 5.4No exploitEPSS 0%

    gibbonedu · gibbonNov 14, 2023

  • CVE-2022-22868
    19Monitor

    Gibbon CMS v22.0.01 was discovered to contain a cross-site scripting (XSS) vulnerability, that allows attackers to inject arbitrary script v

    MediumCVSS 4.8No exploitEPSS 0%

    gibbonedu · gibbonJan 28, 2022

  • CVE-2024-51337
    14Monitor

    Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive informatio

    LowCVSS 3.5No exploitEPSS 0%

    gibbonedu · gibbonNov 21, 2024