Gridbox Extension For Joomla
Monthly
Unauthenticated SQL injection in the Balbooa Gridbox extension for Joomla before 2.20.4.2 allows remote attackers to inject into the ORDER BY clause via the sort-by parameter on store product list pages and extract database contents. The issue requires a published Gridbox store/product listing page to be reachable but no authentication or user interaction, and the independent assessment limits impact to confidentiality (C:H/I:N/A:N). EPSS is modest at 0.39% (32nd percentile), yet the priority decision is act_now; no public exploit identified at time of analysis.
Missing authorization in the Balbooa Gridbox extension for Joomla (versions 1.0.0 through 2.20.4.1) allows unauthenticated remote requests to invoke the EditorController::getBlogPosts() task and read blog-post data without the edit-level check applied to other controller tasks. The supplied CVSS 4.0 score is 9.3 with high confidentiality, integrity, and availability impact, but the independent assessment is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so the demonstrated impact should be treated as unauthorized blog-post read or exposure rather than data modification or denial of service. No public exploit was identified at time of analysis; EPSS is 0.32% (24th percentile), the fixed release is 2.20.4.2, and the vuln.today decision label is act_now despite the independent assessment noting conflicting signals.
Cross-site request forgery (CSRF) in the Gridbox extension for Joomla before 2.20.4.0 allows unauthenticated attackers to install arbitrary language packs by tricking a logged-in administrator (or any user with the core.tools permission) into visiting a crafted URL. The PagesController's addLanguage action fails to enforce the POST method, bypassing Joomla's session-token validation, which is only applied to POST requests. No public exploit code was identified at time of analysis; exploitation requires user interaction (the victim must be authenticated with core.tools).
Cross-site request forgery in balbooa Gridbox, a page-builder extension for Joomla, allows attackers to forge state-changing admin actions in versions prior to 2.20.2 by tricking an authenticated administrator into loading a malicious page. The flaw spans multiple CSRF vectors in the admin interface and carries high confidentiality and integrity impact (CVSS 7.3), though EPSS is only 0.10% and no public exploit identified at time of analysis. SSVC rates exploitation as 'none' with 'total' technical impact, indicating serious potential consequence but no observed weaponization.
Authentication bypass in the Gridbox page-builder extension for Joomla (versions before 2.20.2) lets remote unauthenticated attackers take over any account on the target site. The flaw resides in the extension's socialLogin method, which fails to properly verify identity and allows an actor to authenticate as any chosen user - including administrators. Rated CVSS 4.0 10.0 (CWE-284 Improper Access Control); no public exploit is identified at time of analysis, though the vendor product page and a third-party research blog document Gridbox critical issues.
Unauthenticated account takeover in the Gridbox page-builder extension for Joomla (versions before 2.20.2) allows any remote attacker to reset the password of arbitrary user accounts through the exposed resetPassword method, then log in and act as those users. Super administrator accounts are explicitly out of scope, but all other roles - including regular administrators, editors, and managers - can be seized. The maximum CVSS 4.0 base score of 10.0 reflects unauthenticated, low-complexity, network-reachable exploitation; no public exploit has been identified at time of analysis, though the CVSS threat metrics flag automatability and exploitation evidence.
Arbitrary file read in the Balbooa Gridbox page-builder extension for Joomla (all versions before 2.20.2) lets remote unauthenticated attackers read files outside the intended web root through the extension's photo viewer component. The flaw is a classic path traversal (CWE-22) reachable over the network with no authentication or user interaction, enabling disclosure of configuration files, credentials, and other sensitive server content. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated SQL injection in Balbooa's Gridbox extension for Joomla (versions before 2.20.2) lets remote attackers inject malicious SQL through multiple untrusted input vectors without any login. The flaw carries a CVSS 4.0 base score of 9.2 (Critical) and can expose database contents including Joomla user credentials and session data. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature makes it a strong patching priority.
Arbitrary recursive directory deletion in the Gridbox extension for Joomla (versions before 2.20.2) lets remote unauthenticated attackers destroy directory trees on the server through the exposed generateNewApp method, which fails to enforce access control (authentication bypass). Rated CVSS 4.0 9.2 (Critical) with a high availability impact on both the vulnerable component and subsequent systems, this is a data-destruction / denial-of-service flaw rather than a code-execution or data-theft one. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in the balbooa Gridbox extension for Joomla (versions before 2.20.2) lets unauthenticated actors self-register accounts while supplying arbitrary Joomla usergroup IDs, so an attacker can create an account placed directly into an administrative usergroup. Because the registration handler trusts client-supplied group assignments, exploitation grants full site takeover with no prior credentials. No public exploit has been identified at time of analysis, but the trivial network-based nature makes it high priority.
Arbitrary file upload in the Balbooa Gridbox page-builder extension for Joomla (versions before 2.20.2) lets an authenticated user upload files of arbitrary type via the extension's file-upload methods, bypassing type restrictions (CWE-434). Uploading executable server-side code (e.g. a PHP web shell) yields authenticated remote code execution, and the vendor rates it CVSS 4.0 9.4 with an 'Attacked' exploit-maturity flag and 'Red' urgency. The impact is materially worse because it chains with CVE-2026-65884, which lets the attacker create the account required to reach the upload feature - collapsing the privilege barrier and effectively enabling attacker-driven RCE. No public exploit is identified at time of analysis, though the CVSS threat metric (E:A) signals the vendor considers exploitation activity present.
Path traversal in the Gridbox extension for Joomla (versions before 2.20.4.0) allows unauthenticated remote attackers to read image files outside the configured images root when a sibling directory sharing the root's name prefix exists. The flaw resides in the site UploaderHelper's prefix-only containment check used by the showImage action; a request-controlled path can resolve to a sibling directory such as 'images-backup' if that directory exists and contains a file with a Gridbox-permitted image extension. Exploitation is limited to image-type files and requires the presence of such a prefix-matching sibling directory; no public exploit code has been identified and CISA SSVC reports no exploitation activity, with independent assessment rating the risk Low.
Unauthenticated file system disclosure in balbooa.com's Gridbox extension for Joomla (versions 1.0.0 through 2.20.1) exposes arbitrary server-side file paths to remote unauthenticated attackers via multiple vulnerable endpoints. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms zero-barrier network exploitation requiring no credentials, interaction, or special configuration. SSVC assesses exploitation as none at time of analysis and the attack as automatable with partial technical impact; EPSS at 0.14% (4th percentile) reflects currently low exploitation probability despite the accessible attack surface. No public exploit code or active exploitation (CISA KEV) has been identified.
Payment bypass in Gridbox (Joomla extension by balbooa.com) versions 1.0.0 through 2.20.1 allows unauthenticated remote attackers to circumvent payment enforcement due to improper authorization checks (CWE-285), enabling acquisition of paid content or order completion without payment. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely exploitable with no authentication or user interaction required. No public exploit has been identified at time of analysis, though SSVC designates the attack as automatable with partial technical impact, raising concerns about systematic financial fraud at scale.
Stored cross-site scripting in the Gridbox Joomla extension by balbooa.com allows attackers to inject persistent malicious scripts via the comment avatar field, affecting all releases from version 1.0.0 through 2.20.1. The payload is stored server-side and executes in the browsers of all subsequent visitors who load the affected page, with scope change enabling cross-origin impact such as session theft or UI manipulation. No public exploit code or active exploitation has been identified at time of analysis; the vendor released version 2.20.2 as the corrective fix.
Unauthenticated SQL injection in the Balbooa Gridbox extension for Joomla before 2.20.4.2 allows remote attackers to inject into the ORDER BY clause via the sort-by parameter on store product list pages and extract database contents. The issue requires a published Gridbox store/product listing page to be reachable but no authentication or user interaction, and the independent assessment limits impact to confidentiality (C:H/I:N/A:N). EPSS is modest at 0.39% (32nd percentile), yet the priority decision is act_now; no public exploit identified at time of analysis.
Missing authorization in the Balbooa Gridbox extension for Joomla (versions 1.0.0 through 2.20.4.1) allows unauthenticated remote requests to invoke the EditorController::getBlogPosts() task and read blog-post data without the edit-level check applied to other controller tasks. The supplied CVSS 4.0 score is 9.3 with high confidentiality, integrity, and availability impact, but the independent assessment is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so the demonstrated impact should be treated as unauthorized blog-post read or exposure rather than data modification or denial of service. No public exploit was identified at time of analysis; EPSS is 0.32% (24th percentile), the fixed release is 2.20.4.2, and the vuln.today decision label is act_now despite the independent assessment noting conflicting signals.
Cross-site request forgery (CSRF) in the Gridbox extension for Joomla before 2.20.4.0 allows unauthenticated attackers to install arbitrary language packs by tricking a logged-in administrator (or any user with the core.tools permission) into visiting a crafted URL. The PagesController's addLanguage action fails to enforce the POST method, bypassing Joomla's session-token validation, which is only applied to POST requests. No public exploit code was identified at time of analysis; exploitation requires user interaction (the victim must be authenticated with core.tools).
Cross-site request forgery in balbooa Gridbox, a page-builder extension for Joomla, allows attackers to forge state-changing admin actions in versions prior to 2.20.2 by tricking an authenticated administrator into loading a malicious page. The flaw spans multiple CSRF vectors in the admin interface and carries high confidentiality and integrity impact (CVSS 7.3), though EPSS is only 0.10% and no public exploit identified at time of analysis. SSVC rates exploitation as 'none' with 'total' technical impact, indicating serious potential consequence but no observed weaponization.
Authentication bypass in the Gridbox page-builder extension for Joomla (versions before 2.20.2) lets remote unauthenticated attackers take over any account on the target site. The flaw resides in the extension's socialLogin method, which fails to properly verify identity and allows an actor to authenticate as any chosen user - including administrators. Rated CVSS 4.0 10.0 (CWE-284 Improper Access Control); no public exploit is identified at time of analysis, though the vendor product page and a third-party research blog document Gridbox critical issues.
Unauthenticated account takeover in the Gridbox page-builder extension for Joomla (versions before 2.20.2) allows any remote attacker to reset the password of arbitrary user accounts through the exposed resetPassword method, then log in and act as those users. Super administrator accounts are explicitly out of scope, but all other roles - including regular administrators, editors, and managers - can be seized. The maximum CVSS 4.0 base score of 10.0 reflects unauthenticated, low-complexity, network-reachable exploitation; no public exploit has been identified at time of analysis, though the CVSS threat metrics flag automatability and exploitation evidence.
Arbitrary file read in the Balbooa Gridbox page-builder extension for Joomla (all versions before 2.20.2) lets remote unauthenticated attackers read files outside the intended web root through the extension's photo viewer component. The flaw is a classic path traversal (CWE-22) reachable over the network with no authentication or user interaction, enabling disclosure of configuration files, credentials, and other sensitive server content. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated SQL injection in Balbooa's Gridbox extension for Joomla (versions before 2.20.2) lets remote attackers inject malicious SQL through multiple untrusted input vectors without any login. The flaw carries a CVSS 4.0 base score of 9.2 (Critical) and can expose database contents including Joomla user credentials and session data. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature makes it a strong patching priority.
Arbitrary recursive directory deletion in the Gridbox extension for Joomla (versions before 2.20.2) lets remote unauthenticated attackers destroy directory trees on the server through the exposed generateNewApp method, which fails to enforce access control (authentication bypass). Rated CVSS 4.0 9.2 (Critical) with a high availability impact on both the vulnerable component and subsequent systems, this is a data-destruction / denial-of-service flaw rather than a code-execution or data-theft one. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in the balbooa Gridbox extension for Joomla (versions before 2.20.2) lets unauthenticated actors self-register accounts while supplying arbitrary Joomla usergroup IDs, so an attacker can create an account placed directly into an administrative usergroup. Because the registration handler trusts client-supplied group assignments, exploitation grants full site takeover with no prior credentials. No public exploit has been identified at time of analysis, but the trivial network-based nature makes it high priority.
Arbitrary file upload in the Balbooa Gridbox page-builder extension for Joomla (versions before 2.20.2) lets an authenticated user upload files of arbitrary type via the extension's file-upload methods, bypassing type restrictions (CWE-434). Uploading executable server-side code (e.g. a PHP web shell) yields authenticated remote code execution, and the vendor rates it CVSS 4.0 9.4 with an 'Attacked' exploit-maturity flag and 'Red' urgency. The impact is materially worse because it chains with CVE-2026-65884, which lets the attacker create the account required to reach the upload feature - collapsing the privilege barrier and effectively enabling attacker-driven RCE. No public exploit is identified at time of analysis, though the CVSS threat metric (E:A) signals the vendor considers exploitation activity present.
Path traversal in the Gridbox extension for Joomla (versions before 2.20.4.0) allows unauthenticated remote attackers to read image files outside the configured images root when a sibling directory sharing the root's name prefix exists. The flaw resides in the site UploaderHelper's prefix-only containment check used by the showImage action; a request-controlled path can resolve to a sibling directory such as 'images-backup' if that directory exists and contains a file with a Gridbox-permitted image extension. Exploitation is limited to image-type files and requires the presence of such a prefix-matching sibling directory; no public exploit code has been identified and CISA SSVC reports no exploitation activity, with independent assessment rating the risk Low.
Unauthenticated file system disclosure in balbooa.com's Gridbox extension for Joomla (versions 1.0.0 through 2.20.1) exposes arbitrary server-side file paths to remote unauthenticated attackers via multiple vulnerable endpoints. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms zero-barrier network exploitation requiring no credentials, interaction, or special configuration. SSVC assesses exploitation as none at time of analysis and the attack as automatable with partial technical impact; EPSS at 0.14% (4th percentile) reflects currently low exploitation probability despite the accessible attack surface. No public exploit code or active exploitation (CISA KEV) has been identified.
Payment bypass in Gridbox (Joomla extension by balbooa.com) versions 1.0.0 through 2.20.1 allows unauthenticated remote attackers to circumvent payment enforcement due to improper authorization checks (CWE-285), enabling acquisition of paid content or order completion without payment. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely exploitable with no authentication or user interaction required. No public exploit has been identified at time of analysis, though SSVC designates the attack as automatable with partial technical impact, raising concerns about systematic financial fraud at scale.
Stored cross-site scripting in the Gridbox Joomla extension by balbooa.com allows attackers to inject persistent malicious scripts via the comment avatar field, affecting all releases from version 1.0.0 through 2.20.1. The payload is stored server-side and executes in the browsers of all subsequent visitors who load the affected page, with scope change enabling cross-origin impact such as session theft or UI manipulation. No public exploit code or active exploitation has been identified at time of analysis; the vendor released version 2.20.2 as the corrective fix.