Vendors / Balbooa Records 33 All Threatist records
Exploited (KEV) 1
CVSS critical 14
CVSS high 11
Exploited now Balbooa records in CISA KEV
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 52
The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is vulnerable to cross-site scripting, caused by improper validation of user-supplied input.
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.32933 · Published 2018-06-14 · No fix listed CWE-79
Priority MEDIUM 49
Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.
CVSS 4.0 CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00517 · Published 2026-07-29 · No fix listed CWE-284
Priority MEDIUM 49
Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding supe…
CVSS 4.0 CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00517 · Published 2026-07-29 · No fix listed CWE-284
Priority MEDIUM 49
Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permis…
CVSS 4.0 CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00517 · Published 2026-07-29 · No fix listed CWE-284
Priority MEDIUM 46
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.
CVSS 4.0 CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.00502 · Published 2026-07-29 · No fix listed CWE-89
Priority MEDIUM 46
Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories.
CVSS 4.0 CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.00436 · Published 2026-07-29 · No fix listed CWE-22
Priority MEDIUM 46
Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files.
CVSS 4.0 CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.00552 · Published 2026-07-29 · No fix listed CWE-22
Priority MEDIUM 43
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files.
CVSS 4.0 CRITICAL 9.4· Network · High privileges · No interaction · EPSS 0.00521 · Published 2026-07-29 · No fix listed CWE-434
Priority LOW 33
Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2
CVSS 3.1 HIGH 7.3· Network · Low privileges · User interaction · EPSS 0.0019 · Published 2026-07-29 · No fix listed CWE-352
Priority LOW 30
Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00347 · Published 2026-07-29 · No fix listed CWE-200
Priority LOW 30
Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00345 · Published 2026-07-29 · No fix listed CWE-285
Priority LOW 27
Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00266 · Published 2026-07-29 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
14 11 8 0 0
THREATIST.IORead the docs