CVE Tools
Track your stack

Gibbonedu

4 CVEs tracked since 2023. Since Nov 2023, none of them reached CISA KEV.

Gibbonedu CVEs per month

Nov 2023 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Gibbonedu CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2023-1140
2023-124 or fewer
2024-014 or fewer
2024-024 or fewer
2024-034 or fewer
2024-044 or fewer
2024-055 or fewer
2024-064 or fewer
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-104 or fewer
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-023 or fewer
2025-035 or fewer
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Gibbonedu's monthly top three, with their CVEs summed over those months.

  1. Gibbon41 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Gibbonedu.

  1. CVE-2026-97864GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication5.3
  2. CVE-2026-8209Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction results in deletion of ...—
  3. CVE-2026-8208Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing interpretation of a user provided .zip as ...—
  4. CVE-2026-8207Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://github.com/GibbonEdu/core/blob/c431e25fdc874adece5d2dc7e408e9...—
  5. CVE-2025-26211Gibbon before 29.0.00 allows CSRF.3.7
  6. CVE-2024-51337Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive information via the email parameter found in /Gibbon/modules/User A...3.5
  7. CVE-2024-34831cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter in the library_manage_catalog_editProcess.php component.6.1
  8. CVE-2024-24724Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (mess...9.8
  9. CVE-2024-24725Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessmen...8.8
  10. CVE-2023-45881GibbonEdu Gibbon through version 25.0.0 allows /modules/Planner/resources_addQuick_ajaxProcess.php file upload with resultant XSS. The imageAsLinks parameter must be set to Y to return HTML code. T...6.1
  11. CVE-2023-45878GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonI...9.8
  12. CVE-2023-45880GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateFileDestination parameter can be set to...7.2
  13. CVE-2023-45879GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager component.5.4
  14. CVE-2023-34599Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.6.1
  15. CVE-2023-34598Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response.9.8

The record

Peak rank
#180 in Nov 2023
Busiest month shown
Nov 2023, 4 CVEs
Months with a KEV entry
0 since Nov 2023
Monthly snapshots
1 since 2023
Gibbonedu's full record, month by month