CVE-2025-26211

Published May 27, 2025

Last updated 8 months ago

CVSS low 3.7

Overview

Description: Gibbon before 29.0.00 allows CSRF.
Source: cve@mitre.org
NVD status: Analyzed
Products: gibbon

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

cve@mitre.org: CWE-352

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:gibbonedu:gibbon:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "886D0280-184C-4E14-A98B-3976FD5A5443",
            "versionEndExcluding": "29.0.00",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive information via the email parameter found in /Gibbon/modules/User Admin/user_manage_editProcess.php.•CVE-2024-51337
cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter in the library_manage_catalog_editProcess.php component.•CVE-2024-34831
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.•CVE-2024-24724
Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.•CVE-2024-24725

References

Sources include official advisories and independent security research.

https://nvd.nist.gov/vuln/detail/CVE-2025-26211
https://github.com/GibbonEdu/core/blob/be891ab97b058a933b68354559457c9e310c13b8/modules/Timetable%20Admin/tt_delete.php#L24
https://github.com/GibbonEdu/core/releases/tag/v29.0.00

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References