PT-2026-39317 · Gibbon · Gibbon

Nikolai Makaroff · Published 2026-05-09 · Updated 2026-05-11 · CVE-2026-8207

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Gibbon versions prior to 30.0.01

Description An authenticated SQL Injection exists in the Tracking/graphing feature. Users with Teacher or higher privileges can abuse this functionality to perform unintended read and write activities on the underlying database. The issue is located in the 'graphing.php' file.

Recommendations Update to version 30.0.01 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-8207

Affected Products

Gibbon

References · 9

• 🔥 https://projectblack.io/blog/gibbon-v30-authenticated-sql-injection-and-rce/#sql-injectiongetting-warmed-up · Exploit
• https://github.com/GibbonEdu/core/releases/tag/v30.0.01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8207 · Security Note
• https://github.com/GibbonEdu/core · Note
• https://twitter.com/CVEarity/status/2053760744337150398 · Twitter Post
• https://twitter.com/CVEnew/status/2053131399906136310 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2053055065758343408 · Twitter Post
• https://t.me/CVEtracker/53196 · Telegram Post
• https://t.me/cveNotify/162843 · Telegram Post