CVE-2026-8207

HighCVSS 7.0/10Last modified Jul 24, 2026

Description

Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://github.com/GibbonEdu/core/blob/c431e25fdc874adece5d2dc7e408e9aa2d1abadb/modules/Tracking/graphing.php#L145 feature. Successful exploitation requires Teacher or higher privileges. Exploitation could result in unintended read/write activities to the underlying database.

Metrics

CVSS 4.0 7.0/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: May 9, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-820706.5A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insuff CVE-2026-820718.1Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supp CVE-2026-820728.8Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via CVE-2026-820736.5A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level CVE-2026-820746.5MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges CVE-2026-820757.5An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client th CVE-2026-820766.5An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/writ CVE-2026-820777.3An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG an CVE-2026-820789.1An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application in CVE-2026-820798.4A stack-based buffer overflow vulnerability in the Nintendo Switch local wireless networking functionality may allow an attacker within wire CVE-2026-82088.9Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directo CVE-2026-820816.4wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export.