Gibbon

Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction results in deletion of the file and a DOS condition. Successful exploitation requires Teacher or higher privileges. Exploitation could result in loss of availability of the web application.

Published: 2026-05-09T03:19:27.757Z
Updated: 2026-05-11T17:45:44.538Z

Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing interpretation of a user provided .zip as PHP. Successful exploitation requires Teacher or higher privileges. Exploitation could result in compromise of the underlying web server.

Published: 2026-05-09T02:58:43.887Z
Updated: 2026-05-11T17:47:19.046Z

Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://github.com/GibbonEdu/core/blob/c431e25fdc874adece5d2dc7e408e9aa2d1abadb/modules/Tracking/graphing.php#L145 feature. Successful exploitation requires Teacher or higher privileges. Exploitation could result in unintended read/write activities to the underlying database.

Published: 2026-05-09T02:41:46.505Z
Updated: 2026-05-11T14:42:39.387Z

Gibbon before 29.0.00 allows CSRF.

Published: 2025-05-27T00:00:00.000Z
Updated: 2025-05-27T14:06:29.032Z

Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive information via the email parameter found in /Gibbon/modules/User Admin/user_manage_editProcess.php.

Published: 2024-11-21T00:00:00.000Z
Updated: 2024-11-21T19:56:23.694Z