Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
gibbonedu gibbon vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2023-45878
GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the pa...
Gibbonedu Gibbon
9.8
CVSSv3
CVE-2023-34598
Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response.
Gibbonedu Gibbon 25.0.00
2 Github repositories
8.8
CVSSv3
CVE-2022-27305
Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.
Gibbonedu Gibbon
7.2
CVSSv3
CVE-2023-45880
GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateFileDestination parameter can be set to an arbitrary pathname (and extension). This allows creation of PHP files outside o...
Gibbonedu Gibbon
6.1
CVSSv3
CVE-2023-45881
GibbonEdu Gibbon through version 25.0.0 allows /modules/Planner/resources_addQuick_ajaxProcess.php file upload with resultant XSS. The imageAsLinks parameter must be set to Y to return HTML code. The filename attribute of the bodyfile1 parameter is reflected in the response.
Gibbonedu Gibbon
6.1
CVSSv3
CVE-2023-34599
Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable malicious users to execute arbitrary Javascript code.
Gibbonedu Gibbon 25.0.00
1 Github repository
6.1
CVSSv3
CVE-2021-40492
A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaScript (gibbonCourseClassID, gibbonPersonID, subpage, currentDate, or allStudents to index.php).
Gibbonedu Gibbon 22.0.00
1 Github repository
5.4
CVSSv3
CVE-2023-45879
GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager component.
Gibbonedu Gibbon
5.4
CVSSv3
CVE-2022-23871
Multiple cross-site scripting (XSS) vulnerabilities in the component outcomes_addProcess.php of Gibbon CMS v22.0.01 allow malicious users to execute arbitrary web scripts or HTML via a crafted payload insterted into the name, category, description parameters.
Gibbonedu Gibbon 22.0.01
5.4
CVSSv3
CVE-2021-40214
Gibbon v22.0.00 suffers from a stored XSS vulnerability within the wall messages component.
Gibbonedu Gibbon 22.0.00
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
NULL pointer dereference
CVE-2023-52689
CVE-2024-23803
client side
CVE-2023-52696
information disclosure
CVE-2024-35843
CVE-2024-27130
CVE-2023-52697
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »