https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 01:50:32 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2023-45880 <p>GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateFileDestination parameter can be set to an arbitrary pathname (and extension). This allows creation of PHP files outside of the uploads directory, directly in the webroot.</p> <p>GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateFileDestination parameter can be set to an arbitrary pathname (and extension). This allows creation of PHP files outside of the uploads directory, directly in the webroot.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2023-45880 https://vulnerability.circl.lu/vuln/ghsa-ffw7-j6wm-254p <p>GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateFileDestination parameter can be set to an arbitrary pathname (and extension). This allows creation of PHP files outside of the uploads directory, directly in the webroot.</p> <p>GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateFileDestination parameter can be set to an arbitrary pathname (and extension). This allows creation of PHP files outside of the uploads directory, directly in the webroot.</p> https://vulnerability.circl.lu/vuln/ghsa-ffw7-j6wm-254p https://vulnerability.circl.lu/vuln/gsd-2023-45880 gsd-2023-45880 https://vulnerability.circl.lu/vuln/gsd-2023-45880