Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
Sep 25, 2026A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01.CVE-2026-97864 · Other software · GibbonEdu · reported by VulDBMedium 5.5
A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/units_add_blockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 31.0.00 is sufficient to fix this issue. The identifier of the patch is 07e719368eae8dfb4e22e19424ceab6074164ebc. It is recommended to upgrade the affected component.
- Product
- Gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2026Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zCVE-2026-8209 · Other software · gibbonedu · reported by ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4aMedium 6.9
Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction results in deletion of the file and a DOS condition. Successful exploitation requires Teacher or higher privileges. Exploitation could result in loss of availability of the web application.
- Product
- gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comprojectblack.io
May 9, 2026Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing interCVE-2026-8208 · Other software · gibbonedu · reported by ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4aHigh 8.9
Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing interpretation of a user provided .zip as PHP. Successful exploitation requires Teacher or higher privileges. Exploitation could result in compromise of the underlying web server.
- Product
- gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comprojectblack.io
May 8, 2026Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://github.com/GibbonEdu/coreCVE-2026-8207 · Other software · gibbonedu · reported by ab69c47f-b95e-4bf2-b2d9-4b1fd1b24b4aHigh 7
Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://github.com/GibbonEdu/core/blob/c431e25fdc874adece5d2dc7e408e9aa2d1abadb/modules/Tracking/graphing.php#L145 feature. Successful exploitation requires Teacher or higher privileges. Exploitation could result in unintended read/write activities to the underlying database.
- Product
- gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comprojectblack.io
May 27, 2025Gibbon before 29.0.00 allows CSRF.CVE-2025-26211 · Other software · GibbonEdu · reported by MITRELow 3.7
Gibbon before 29.0.00 allows CSRF.
- Product
- Gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2024Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive information via the email paraCVE-2024-51337 · Other software · gibbon · reported by MITRELow 3.5
Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive information via the email parameter found in /Gibbon/modules/User Admin/user_manage_editProcess.php.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter in the library_manage_CVE-2024-34831 · Other software · gibbon · reported by MITREMedium 6.1
cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter in the library_manage_catalog_editProcess.php component.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2024Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is pasCVE-2024-24724 · Other software · gibbonedu · reported by MITRECritical 9.8
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.
- Product
- gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgibbonedu.orgpacketstormsecurity.com
Mar 23, 2024Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/CVE-2024-24725 · Other software · gibbonedu · reported by MITREHigh 8.8
Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.
- Product
- gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgibbonedu.orgexploit-db.com
Nov 14, 2023GibbonEdu Gibbon through version 25.0.0 allows /modules/Planner/resources_addQuick_ajaxProcess.php file upload with resultant XSS.CVE-2023-45881 · Other software · Gibbonedu · reported by MITREMedium 6.1
GibbonEdu Gibbon through version 25.0.0 allows /modules/Planner/resources_addQuick_ajaxProcess.php file upload with resultant XSS. The imageAsLinks parameter must be set to Y to return HTML code. The filename attribute of the bodyfile1 parameter is reflected in the response.
- Product
- Gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Nov 14, 2023GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder.CVE-2023-45880 · Other software · Gibbonedu · reported by MITREHigh 7.2
GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateFileDestination parameter can be set to an arbitrary pathname (and extension). This allows creation of PHP files outside of the uploads directory, directly in the webroot.
- Product
- Gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Nov 14, 2023GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager component.CVE-2023-45879 · Other software · Gibbonedu · reported by MITREMedium 5.4
GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager component.
- Product
- Gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Nov 14, 2023GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication.CVE-2023-45878 · Other software · Gibbonedu · reported by MITRECritical 9.8
GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter is set, the defined path is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is base64 decoded and written to the defined file path. This allows creation of PHP files that permit Remote Code Execution (unauthenticated).
- Product
- Gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Jun 29, 2023Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.CVE-2023-34599 · Other software · Gibbonedu · reported by MITREMedium 6.1
Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.
- Product
- Gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2023Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in tCVE-2023-34598 · Other software · Gibbonedu · reported by MITRECritical 9.8
Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response.
- Product
- Gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2022Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.CVE-2022-27305 · Other software · Gibbonedu · reported by MITREHigh 8.8
Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.
- Product
- Gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2022Gibbon v3.4.4 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL.CVE-2022-27311 · Other software · Gibbon Project · reported by MITRECritical 9.8
Gibbon v3.4.4 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL.
- Product
- Gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2022Multiple cross-site scripting (XSS) vulnerabilities in the component outcomes_addProcess.php of Gibbon CMS v22.0.01 allow attackers to execute arbitrary web scrCVE-2022-23871 · Other software · Gibbonedu · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in the component outcomes_addProcess.php of Gibbon CMS v22.0.01 allow attackers to execute arbitrary web scripts or HTML via a crafted payload insterted into the name, category, description parameters.
- Product
- Gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022Gibbon CMS v22.0.01 was discovered to contain a cross-site scripting (XSS) vulnerability, that allows attackers to inject arbitrary script via name parameters.CVE-2022-22868 · Other software · Gibbonedu · reported by MITREMedium 4.8
Gibbon CMS v22.0.01 was discovered to contain a cross-site scripting (XSS) vulnerability, that allows attackers to inject arbitrary script via name parameters.
- Product
- Gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2021Gibbon v22.0.00 suffers from a stored XSS vulnerability within the wall messages component.CVE-2021-40214 · Other software · Gibbonedu · reported by MITREMedium 5.4
Gibbon v22.0.00 suffers from a stored XSS vulnerability within the wall messages component.
- Product
- Gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgibbonedu.orggithub.com
Sep 3, 2021A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaScript (gibbonCourseClCVE-2021-40492 · Other software · Gibbonedu · reported by MITREMedium 6.1
A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaScript (gibbonCourseClassID, gibbonPersonID, subpage, currentDate, or allStudents to index.php).
- Product
- Gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgibbonedu.orggithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.