https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-26211.htmlhttps://patchthecve.com/cve/CVE-2025-26211.htmlWed, 17 Jun 2026 09:01:31 +0000LOW 3.7: Gibbon before 29.0.00 allows CSRF.https://patchthecve.com/cve/CVE-2024-51337.htmlhttps://patchthecve.com/cve/CVE-2024-51337.htmlWed, 17 Jun 2026 08:05:37 +0000LOW 3.5: Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive information via the email parameter found in /Gibbon/modules/User Admin/user_manage_editProcess.php.https://patchthecve.com/cve/CVE-2024-34831.htmlhttps://patchthecve.com/cve/CVE-2024-34831.htmlWed, 17 Jun 2026 07:34:08 +0000MEDIUM 6.1: cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter in the library_manage_catalog_editProcess.php component.https://patchthecve.com/cve/CVE-2024-24724.htmlhttps://patchthecve.com/cve/CVE-2024-24724.htmlWed, 17 Jun 2026 07:14:45 +0000CRITICAL 9.8: Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.https://patchthecve.com/cve/CVE-2024-24725.htmlhttps://patchthecve.com/cve/CVE-2024-24725.htmlWed, 17 Jun 2026 07:14:45 +0000HIGH 8.8: Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.