Gridbox extension for Joomla vulnerabilities
11 known vulnerabilities in Gridbox extension for Joomla from Balbooa.com. 11 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.3 Critical severity
Gridbox extension for Joomla: Improper Access Control
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHe
- 9.3 Critical severity
Gridbox extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the paramet
- 8.7 High severity
Gridbox extension for Joomla: Cross-Site Request Forgery
Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads ur
- 9.8 Critical severity
Gridbox extension for Joomla: Improper Access Control
Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.
- 9.8 Critical severity
Gridbox extension for Joomla: Improper Access Control
Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins.
- 7.5 High severity
Gridbox extension for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files.
- 9.8 Critical severity
Gridbox extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.
- 7.5 High severity
Gridbox extension for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories.
- 8.8 High severity
Gridbox extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can
- 9.8 Critical severity
Gridbox extension for Joomla: Improper Access Control
Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions.
- 9.4 Critical severity
Gridbox extension for Joomla: Authentication Bypass Using an Alternate Path or Channel
Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access.