Gridbox vulnerabilities
7 known vulnerabilities in Gridbox from Balbooa. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
Gridbox extension for Joomla: Improper Access Control
Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.
- 9.8 Critical severity
Gridbox extension for Joomla: Improper Access Control
Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins.
- 7.5 High severity
Gridbox extension for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files.
- 9.8 Critical severity
Gridbox extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.
- 7.5 High severity
Gridbox extension for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories.
- 8.8 High severity
Gridbox extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can
- 9.8 Critical severity
Gridbox extension for Joomla: Improper Access Control
Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions.