Balbooa Gridbox any version

Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2

The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2