116 matches found
CVE-2026-102784
Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request...
CVE-2026-102783
Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then returns the image. If image decoding is...
CVE-2026-102783
The Joomla Extension - balbooa.com - Gridbox (versions
EUVD-2026-94934
Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then returns the image. If image decoding is...
CVE-2026-102783 Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0
Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then returns the image. If image decoding is...
CVE-2026-102783 Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0
Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then returns the image. If image decoding is...
CVE-2026-102784
The Joomla Extension - balbooa.com - Gridbox (versions
CVE-2026-102784 Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0
Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request...
EUVD-2026-94933
Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request...
CVE-2026-102784 Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0
Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request...
CVE-2026-102784: Cross-Site Request Forgery (CSRF)
Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request...
CVE-2026-102783: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then returns the image. If image decoding is...
CVE-2026-65947
Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox 2.20.2...
CVE-2026-65887
Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins...
CVE-2026-65888
Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox 2.20.2 - The socialLogin method allows actors to login as any given user on the target site...
CVE-2026-65886
Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files...
CVE-2026-66488
Joomla Extension - balbooa.com - Payment bypass in Gridbox 2.20.2...
CVE-2026-66489
Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox 2.20.2...