Balbooa

14 CVEs across 3 Balbooa products. Browse Balbooa vulnerabilities, severities, and proof-of-concept exploits.

Balbooa products with known CVEs

ProductCVEs
Gridbox12
Balbooa Joomla Forms Builder1
Forms1
Balbooa CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-65947High7.32026-07-29Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2
CVE-2026-65888Critical9.82026-07-29Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the ta…
CVE-2026-65887Critical9.82026-07-29Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user passwo…
CVE-2026-65886High7.52026-07-29Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary…
CVE-2026-66490Medium6.12026-07-29Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2
CVE-2026-66489Medium5.32026-07-29Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2
CVE-2026-66488Medium5.32026-07-29Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2
CVE-2026-65890Critical9.82026-07-29Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in querie…
CVE-2026-65889High7.52026-07-29Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete director…
CVE-2026-65885High8.82026-07-29Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitra…
CVE-2026-65884Critical9.82026-07-29Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticat…
CVE-2026-56291Critical9.82026-07-09Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauth…
CVE-2021-47930High8.22026-05-10Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form submission handler that allows remote attackers to execu…
CVE-2018-11690Medium6.12018-06-14The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is vulnerable to cross-site scripting, caused by improper validation of user-supp…