Lucene search

K

Gibbonedu Security Vulnerabilities

cve
cve

CVE-2023-45879

GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager...

5.4CVSS

5.6AI Score

0.0004EPSS

2023-11-14 06:15 AM
14
cve
cve

CVE-2023-45878

GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter is...

9.8CVSS

9.7AI Score

0.005EPSS

2023-11-14 06:15 AM
9
cve
cve

CVE-2023-45880

GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateFileDestination parameter can be set to an arbitrary pathname (and extension). This allows creation of PHP files outside of the uploads...

7.2CVSS

6.9AI Score

0.0005EPSS

2023-11-14 06:15 AM
5
cve
cve

CVE-2023-45881

GibbonEdu Gibbon through version 25.0.0 allows /modules/Planner/resources_addQuick_ajaxProcess.php file upload with resultant XSS. The imageAsLinks parameter must be set to Y to return HTML code. The filename attribute of the bodyfile1 parameter is reflected in the...

6.1CVSS

6.2AI Score

0.0005EPSS

2023-11-14 06:15 AM
5
cve
cve

CVE-2023-34598

Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's...

9.8CVSS

9.3AI Score

0.035EPSS

2023-06-29 03:15 PM
20
cve
cve

CVE-2023-34599

Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript...

6.1CVSS

6.3AI Score

0.001EPSS

2023-06-29 03:15 PM
12
cve
cve

CVE-2022-27305

Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session...

8.8CVSS

8.6AI Score

0.002EPSS

2022-05-25 04:15 PM
51
2
cve
cve

CVE-2022-23871

Multiple cross-site scripting (XSS) vulnerabilities in the component outcomes_addProcess.php of Gibbon CMS v22.0.01 allow attackers to execute arbitrary web scripts or HTML via a crafted payload insterted into the name, category, description...

5.4CVSS

5.4AI Score

0.001EPSS

2022-02-03 03:15 AM
34
cve
cve

CVE-2022-22868

Gibbon CMS v22.0.01 was discovered to contain a cross-site scripting (XSS) vulnerability, that allows attackers to inject arbitrary script via name...

4.8CVSS

5AI Score

0.001EPSS

2022-01-28 07:15 PM
98
cve
cve

CVE-2021-40214

Gibbon v22.0.00 suffers from a stored XSS vulnerability within the wall messages...

5.4CVSS

5.1AI Score

0.001EPSS

2021-09-13 12:15 PM
17
cve
cve

CVE-2021-40492

A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaScript (gibbonCourseClassID, gibbonPersonID, subpage, currentDate, or allStudents to...

6.1CVSS

6.1AI Score

0.001EPSS

2021-09-03 05:15 PM
25