CVE-2024-24725: Gibbonedu Gibbon

High severity, CVSS 8.8. EPSS: 51.3% chance of exploitation in the next 30 days.

Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.

Affected products

• Gibbonedu Gibbon: up to and including 26.0.00

Published 2024-03-23. Last modified 2026-06-17.