Gibbon vulnerabilities
6 known CVE vulnerabilities in Gibbon, translated and rated.
- CVE-2023-34598Critical
Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response.
- CVE-2026-8209Medium
Gibbon before version 30.0.01 has a path traversal vulnerability leading to DoS by attempting extraction of PHP files. Failed .zip extraction results in file deletion and DoS. Teacher or higher privileges required.
- CVE-2026-8208High
Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing interpretation of a user-provided .zip as PHP. Successful exploitation requires Teacher or higher privileges.
- CVE-2026-8207High
Gibbon before version v30.0.01 has an SQL injection vulnerability in the Tracking/graphing feature. An authenticated user with Teacher or higher privileges can inject SQL, leading to unauthorized read/write in the database.
- CVE-2023-34599Medium
Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.
- CVE-2022-27305High
Gibbon v23 does not generate a new session ID after user authentication, making it vulnerable to session fixation attacks. An attacker can force a victim to use a known session ID and then hijack the session after login.