Gibbon LMS <= v25.0.01 - File Upload to RCE

Gibbon LMS versions 25.0.1 and earlier are vulnerable to an Arbitrary File Upload that can lead to Remote Code Execution RCE. The issue stems from the rubricsvisualisesaveAjax.php endpoint, which, notably, does not require authentication. Because of this, unauthenticated attackers could potential...

Gibbon v25.0.0 - Cross-Site Scripting

Multiple Cross-Site Scripting XSS vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code. id: CVE-2023-34599 info: name: Gibbon v25.0.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Multiple Cross-Site...

Gibbon v25.0.0 - Local File Inclusion

Gibbon v25.0.0 is vulnerable to a Local File Inclusion LFI vulnerability where it's possible to include the content of several files present in the installation folder in the server's response. id: CVE-2023-34598 info: name: Gibbon v25.0.0 - Local File Inclusion author: DhiyaneshDk severity:...

CVE-2023-34599

CVE-2023-34599 Sono state identificate multiple vulnerabilità di Cross-Site Scripting XSS in Gibbon v25.0.0, che consentono agli attaccanti di eseguire codice JavaScript arbitrario. Prova di concetto Parametro allUsers http://gibbon.local/index.php?q=/modules/Timetable...

CVE-2023-45878-POC

CVE-2023-45878-POC CVE-2023-45878 PoC per Gibbon LMS su XAMPP Windows. Carica una webshell chiamata shell.php per l'iniezione di comandi. Per la reverse shell carica uno script PowerShell di reverse shell ps1 chiamato shell.ps1 che viene caricato sulla macchina target usando shell.php. Requisiti...

CVE-2023-34598

CVE-2023-34598 - Gibbon v25.0.0 Exploit LFI Questa repository contiene uno script Python che aiuta a identificare e sfruttare una vulnerabilità di inclusione locale di file LFI CVE-2023-34598 in Gibbon v25.0.0. Lo script può eseguire la scansione di un sito web target per individuare una potenzia...

CVE-2023-34598

Gibbon v25.0.0 - Inclusioni locali di file - CVE-2023-34598 Gibbon v25.0.0 è vulnerabile a una vulnerabilità di inclusione locale di file LFI, dove è possibile includere il contenuto di diversi file presenti nella cartella di installazione nella risposta del server. Prova di concetto Per sfruttar...

CVE-2023-45878_to_RCE

CVE-2023-45878 zu RCE Dieses Skript verknüpft und automatisiert Arbitrary File Write zu RCE auf Gibbon LMS durch Ausnutzung von CVE-2023-45878. Das Skript führt die folgenden Schritte aus: 1. Erzeugt eine stageless Reverse Shell von msfvenom für Windows 2. Lädt eine Webshell hoch, die...

gibbonlms-filewrite_rce

Gibbon LMS Scrittura Arbitraria di File / RCE Informazioni sulla Vulnerabilità Scrittura Arbitraria di File in Gibbon LMS per RCE CVE-2023-45878 GibbonEdu Gibbon LMS versione 25.0.1 e precedenti permette la scrittura arbitraria di file perché rubricsvisualisesaveAjax.php non richiede...

CVE-2023-45878

CVE-2023-45878 Exploit GibbonEdu Gibbon versione 25.0.1 GibbonEdu Gibbon versione 25.0.1 e precedenti GibbonEdu Gibbon versione 25.0.1 e precedenti consente la scrittura arbitraria di file Leggi di più https://nvd.nist.gov/vuln/detail/CVE-2023-45878...

CVE-2023-45878

Exploit Gibbon CMS CVE-2023-45878 Questo script Python sfrutta CVE-2023-45878, una vulnerabilità di caricamento arbitrario di file non autenticato in Gibbon CMS versioni 25.0.1 e precedenti, che porta all'esecuzione remota di codice RCE. Descrizione della vulnerabilità CVE-2023-45878 esiste...

CVE-2023-45878

CVE-2023-45878 Ho scritto questo script basandomi sul lavoro di https://herolab.usd.de/security-advisories/usd-2023-0025/ . L'exploit sfrutta una vulnerabilità di scrittura arbitraria di file in Gibbon LMS 25.0.1. Questa PoC caricherà un semplice script php cmd, e poi lo userà per caricare una...

CVE-2021-40492

CVE-2021-40492 CVE-2021-40492 Gibbon versione 22 Vulnerabilità di Reflected Cross Site Scripting XSS. https://vulners.com/cve/CVE-2021-40492 Esiste una vulnerabilità di Reflected Cross Site Scripting in più pagine della versione 22 dell'applicazione educativa Gibbon che consente l'esecuzione...

CVE-2023-34598

CVE-2023-34598 Vulnerabilità di inclusione di file locali in Gibbon CVE-2023-34598...

CVE-2026-97864

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...

EUVD-2026-87066

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...

CVE-2026-97864 GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...

CVE-2026-97864 GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...

CVE-2026-97864

A vulnerability exists in GibbonEdu Gibbon (versions up to 30.0.01 ) within the Unit Planner component. Specifically, the makeBlock function in the file modules/Planner/units_add_blockAjax.php fails to perform proper authentication when the gibbonUnitBlockID/mode argument is manipulated. This fla...

CVE-2026-97864 GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...