CVE-2018-11690

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/148127/Joomla-2.4.0-Gridbox-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Jun/26Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/542066/100/0/threadedExploit, Third Party Advisory, VDB Entry
https://vel.joomla.org/resolved/2155-gridbox-com-gridbox-multiple-vulnerabilitiesVendor Advisory
https://vulmon.com/vulnerabilitydetails?qid=CVE-2018-11690Exploit, Third Party Advisory
http://packetstormsecurity.com/files/148127/Joomla-2.4.0-Gridbox-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Jun/26Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/542066/100/0/threadedExploit, Third Party Advisory, VDB Entry
https://vel.joomla.org/resolved/2155-gridbox-com-gridbox-multiple-vulnerabilitiesVendor Advisory
https://vulmon.com/vulnerabilitydetails?qid=CVE-2018-11690Exploit, Third Party Advisory

Timeline

Published: Jun 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-116919.8Emerson DeltaV Smart Switch Command Center application, available in versions 11.3.x and 12.3.1, was unable to change the DeltaV Smart Switc CVE-2018-116929.8An issue was discovered on Canon LBP6650, LBP3370, LBP3460, and LBP7750C devices. It is possible to bypass the Administrator Mode authentica CVE-2018-116938.1An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::skip_ov CVE-2018-116948.8An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Functions::selector_append whic CVE-2018-116958.8An issue was discovered in LibSass <3.5.3. A NULL pointer dereference was found in the function Sass::Expand::operator which could be levera CVE-2018-116968.8An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Inspect::operator which could b CVE-2018-116978.1An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::exactly CVE-2018-116988.1An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::handle_error whic CVE-2018-11708.8This vulnerability allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installations of Volkswagen CVE-2018-117017.8FastStone Image Viewer 6.2 has a User Mode Write AV at 0x005cb509, triggered when the user opens a malformed JPEG file that is mishandled by CVE-2018-117027.8FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00578cb3, triggered when the user opens a malformed JPEG file that is mishandled by CVE-2018-117037.8FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00402d6a, triggered when the user opens a malformed JPEG file that is mishandled by