CVE-2023-45878

CVE-2023-45878 CVE-2023-45878 GibbonEdu Escritura Arbitraria de Archivos...

CVE-2023-45878

CVE-2023-45878 GibbonEdu: Escritura arbitraria de archivos para ejecución de una web shell Descripción Este repositorio contiene un exploit para CVE-2023-45878 , una vulnerabilidad de escritura arbitraria de archivos en GibbonEdu. La vulnerabilidad afecta al endpoint rubricsvisualisesaveAjax.php ...

Gibbon v25.0.0 - Cross-Site Scripting

Multiple Cross-Site Scripting XSS vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code. id: CVE-2023-34599 info: name: Gibbon v25.0.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Multiple Cross-Site...

Gibbon v25.0.0 - Local File Inclusion

Gibbon v25.0.0 is vulnerable to a Local File Inclusion LFI vulnerability where it's possible to include the content of several files present in the installation folder in the server's response. id: CVE-2023-34598 info: name: Gibbon v25.0.0 - Local File Inclusion author: DhiyaneshDk severity:...

CVE-2023-45878

CVE-2023-45878 GibbonEdu Gibbon 漏洞利用版本 25.0.1 GibbonEdu Gibbon 版本 25.0.1 及之前 GibbonEdu Gibbon 版本 25.0.1 及之前存在任意文件写入漏洞 更多信息 https://nvd.nist.gov/vuln/detail/CVE-2023-45878 https://herolab.usd.de/security-advisories/usd-2023-0025/ 免责声明...

CVE-2024-34831

CVE-2024-34831 在 GibbonEdu Core v26.0.00 中的 XSS 漏洞导致权限提升 Gibbon 是一个功能齐全的开源学校管理系统。目前正在大力重构较为陈旧的代码库。 作者：Christian Bajada 1. 漏洞 编辑/提交新书籍时 /modules/Library/librarymanagecatalogeditProcess.php 的 imageLink 参数容易受到 XSS 攻击。具有管理目录权限的用户可以利用此漏洞，导致具有更高级别权限的用户执行任意脚本，从而提升权限。 2. 概念验证（PoC）简单场景 1. 导航至 学习 图书馆 管理目录...

CVE-2026-97864

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...

EUVD-2026-87066

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...

CVE-2026-97864 GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...

CVE-2026-97864

A vulnerability exists in GibbonEdu Gibbon (versions up to 30.0.01 ) within the Unit Planner component. Specifically, the makeBlock function in the file modules/Planner/units_add_blockAjax.php fails to perform proper authentication when the gibbonUnitBlockID/mode argument is manipulated. This fla...

CVE-2026-97864 GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...

CVE-2026-97864 GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...

CVE-2026-97864: Missing Authentication for Critical Function

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...

CVE-2023-45881

GibbonEdu Gibbon through version 25.0.0 allows /modules/Planner/resourcesaddQuickajaxProcess.php file upload with resultant XSS. The imageAsLinks parameter must be set to Y to return HTML code. The filename attribute of the bodyfile1 parameter is reflected in the response...

EUVD-2023-50144

Malicious code in bioql PyPI...

EUVD-2023-50145

Malicious code in bioql PyPI...

EUVD-2023-50146

Malicious code in bioql PyPI...

CVE-2023-45879

GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager component...

CVE-2023-45880

GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateFileDestination parameter can be set to an arbitrary pathname and extension. This allows creation of PHP files outside of the uploads...

CVE-2023-45878

GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubricsvisualisesaveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter is set...