Gridbox vulnerabilities

The Joomla extension Gridbox before version 2.20.2 has an account takeover vulnerability. The socialLogin method allows an attacker to log in as any user on the target site.

Joomla Extension Gridbox below version 2.20.2 has a vulnerability allowing an unauthenticated attacker to reset any user's password (excluding super admins). This allows logging in and acting as those users.

Joomla Extension Gridbox below version 2.20.2 has multiple SQL injection vectors allowing an unauthenticated attacker to inject SQL queries.

Joomla Extension Gridbox below version 2.20.2 has a privilege escalation vulnerability. The registration method allows users to provide usergroup IDs, enabling an unauthenticated attacker to register an account with administrative permissions.

The Joomla extension Gridbox versions below 1.6.0 contains an authentication bypass vulnerability. An attacker can gain full administrative access without providing valid credentials.

Joomla Extension Gridbox from balbooa.com versions < 2.20.2 has various CSRF vectors in the admin interface.

Joomla Extension Gridbox below version 2.20.2 has a vulnerability allowing an unauthenticated attacker to read arbitrary files via the photo viewer.

Joomla Extension - balbooa.com - contains a stored cross-site scripting vulnerability via a comment avatar in Gridbox before version 2.20.2.

Joomla Extension Gridbox from balbooa.com versions < 2.20.2 has various unauthenticated file system disclosure vectors.

Joomla Extension Gridbox from balbooa.com versions < 2.20.2 has a payment bypass vulnerability.

Joomla Extension Gridbox below version 2.20.2 has a vulnerability allowing an unauthenticated attacker to recursively delete directories via the generateNewApp method.

Joomla Extension Gridbox below version 2.20.2 has a vulnerability allowing an authenticated attacker to upload arbitrary files. Combined with CVE-2026-65884, it can lead to remote code execution (RCE).