CVE-2021-40492: Gibbonedu Gibbon

Medium severity, CVSS 6.1. EPSS: 2.3% chance of exploitation in the next 30 days.

A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaScript (gibbonCourseClassID, gibbonPersonID, subpage, currentDate, or allStudents to index.php).

Affected products

• Gibbonedu Gibbon: version 22.0.00 only

Published 2021-09-03. Last modified 2026-06-17.