CVE Tools
Track your stack

Gibbon

21 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Gibbon, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Gibbon CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Gibbon CVEs per month
MonthCVEs
2024-111
2024-120
2025-010
2025-020
2025-030
2025-040
2025-051
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-053
2026-060
2026-070
2026-080
2026-091
2026-100

Severity

How the 21 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical422%
  • High317%
  • Medium950%
  • Low211%

Latest CVEs

The 15 most recently published vulnerabilities affecting Gibbon.

  1. CVE-2026-97864GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication5.3
  2. CVE-2026-8209Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction results in deletion of ...—
  3. CVE-2026-8208Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing interpretation of a user provided .zip as ...—
  4. CVE-2026-8207Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://github.com/GibbonEdu/core/blob/c431e25fdc874adece5d2dc7e408e9...—
  5. CVE-2025-26211Gibbon before 29.0.00 allows CSRF.3.7
  6. CVE-2024-51337Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive information via the email parameter found in /Gibbon/modules/User A...3.5
  7. CVE-2024-34831cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter in the library_manage_catalog_editProcess.php component.6.1
  8. CVE-2024-24724Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (mess...9.8
  9. CVE-2024-24725Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessmen...8.8
  10. CVE-2023-45881GibbonEdu Gibbon through version 25.0.0 allows /modules/Planner/resources_addQuick_ajaxProcess.php file upload with resultant XSS. The imageAsLinks parameter must be set to Y to return HTML code. T...6.1
  11. CVE-2023-45878GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonI...9.8
  12. CVE-2023-45880GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateFileDestination parameter can be set to...7.2
  13. CVE-2023-45879GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager component.5.4
  14. CVE-2023-34599Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.6.1
  15. CVE-2023-34598Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response.9.8

Product grouping is registry-driven, with AI assist and human review. How it works