Balbooa.com 16 CVEs across 4 Balbooa.com products. Browse Balbooa.com vulnerabilities, severities, and proof-of-concept exploits.
Balbooa.com products with known CVEs Balbooa.com CVEs — newest first CVE Severity Score Published Summary CVE-2026-65947High 7.32026-07-29 Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2 CVE-2026-65888Critical 9.82026-07-29 Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the ta… CVE-2026-65887Critical 9.82026-07-29 Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user passwo… CVE-2026-65886High 7.52026-07-29 Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary… CVE-2026-66490Medium 6.12026-07-29 Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2 CVE-2026-66489Medium 5.32026-07-29 Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2 CVE-2026-66488Medium 5.32026-07-29 Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2 CVE-2026-65890Critical 9.82026-07-29 Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in querie… CVE-2026-65889High 7.52026-07-29 Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete director… CVE-2026-65885High 8.82026-07-29 Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitra… CVE-2026-65884Critical 9.82026-07-29 Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticat… CVE-2026-658802026-07-28 Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An insecure form processing logic allowed code execution for… CVE-2026-614252026-07-20 Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially lea… CVE-2026-56291Critical 9.82026-07-09 Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauth… CVE-2025-494862025-07-18 A stored XSS vulnerability in the Balbooa Gallery plugin 1.0.0-2.4.0 for Joomla allows privileged users to store malicious scripts in gallery items. CVE-2025-494852025-07-18 A SQL injection vulnerability in the Balbooa Forms plugin 1.0.0-2.3.1.1 for Joomla allows privileged users to execute arbitrary SQL commands via the 'id' param…