Balbooa.com Gridbox Extension For Joomla
16 CVEs affecting Balbooa.com Gridbox Extension For Joomla. Latest disclosed: 2026-10-27. Critical: 4, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-65888 | Critical | 9.8 | 2026-07-29 | Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the ta… |
CVE-2026-65887 | Critical | 9.8 | 2026-07-29 | Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user passwo… |
CVE-2026-65890 | Critical | 9.8 | 2026-07-29 | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in querie… |
CVE-2026-65884 | Critical | 9.8 | 2026-07-29 | Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticat… |
CVE-2026-65885 | High | 8.8 | 2026-07-29 | Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitra… |
CVE-2026-65886 | High | 7.5 | 2026-07-29 | Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary… |
CVE-2026-65889 | High | 7.5 | 2026-07-29 | Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete director… |
CVE-2026-65947 | High | 7.3 | 2026-07-29 | Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2 |
CVE-2026-66490 | Medium | 6.1 | 2026-07-29 | Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2 |
CVE-2026-66489 | Medium | 5.3 | 2026-07-29 | Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2 |
CVE-2026-66488 | Medium | 5.3 | 2026-07-29 | Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2 |
CVE-2026-102789 | | 2026-10-27 | Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order… | |
CVE-2026-102788 | | 2026-10-27 | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is r… | |
CVE-2026-102784 | | 2026-10-08 | Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session toke… | |
CVE-2026-102783 | | 2026-10-08 | Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site Uploa… | |
CVE-2026-61425 | | 2026-07-20 | Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially lea… |