Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

33 records

Vendor: Balbooa Clear all filters
TI-2026-85552 CVE-2026-107130 · GHSA-2pcj-5cmc-2hm6

Unauthenticated file deletion in Joomla Gridbox extension

Priority LOW 37

Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00375 Published 2026-11-05 No fix listed CWE-639
TI-2026-85548 CVE-2026-105607 · GHSA-4798-73r6-xh3r

Stored cross-site scripting in Gridbox Joomla extension widget

Priority LOW 39

Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00305 Published 2026-11-05 No fix listed CWE-79
TI-2026-81068 CVE-2026-102788 · GHSA-hqjq-crc6-5fp3

Unauthenticated SQL injection in Gridbox extension for Joomla

Priority MEDIUM 48

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to Gridbox…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00386 Published 2026-10-27 No fix listed CWE-89
TI-2026-81045 CVE-2026-102789 · GHSA-rhxp-7mw6-3gpp

Missing authorization in Gridbox Joomla extension editor task

Priority MEDIUM 48

Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() .

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00315 Published 2026-10-27 No fix listed CWE-284
TI-2026-69486 CVE-2026-102783 · GHSA-89x5-vmf9-w5cx

Path traversal in Joomla Gridbox extension image preview

Priority LOW 29

Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper .

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00473 Published 2026-10-08 No fix listed CWE-22
TI-2026-69487 CVE-2026-102784 · GHSA-j9q5-m57g-9vj5

Cross-site request forgery in Gridbox Joomla language installation

Priority LOW 39

Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00171 Published 2026-10-08 No fix listed CWE-352
TI-2026-65393 CVE-2026-102424 · GHSA-j3r3-fqf7-gc2r

Path traversal in Balbooa Forms extension for Joomla

Priority MEDIUM 45

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during…

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00373 Published 2026-09-29 No fix listed CWE-22
TI-2026-65394 CVE-2026-102425 · GHSA-r3hx-8v55-pg55

Code injection in Balbooa Forms extension for Joomla

Priority MEDIUM 50

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.00586 Published 2026-09-29 No fix listed CWE-94
TI-2026-65138 CVE-2026-101126 · GHSA-5w98-66mc-mjqc

Path traversal in Balbooa Forms extension for Joomla

Priority LOW 36

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00245 Published 2026-09-29 No fix listed CWE-22
TI-2026-65137 CVE-2026-101112 · GHSA-4rr9-73qg-q46x

Authorization bypass in Balbooa Forms extension for Joomla

Priority LOW 36

Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00214 Published 2026-09-29 No fix listed CWE-639
TI-2026-65139 CVE-2026-101127 · GHSA-r586-6h3h-vc7q

Cross-site scripting in Balbooa Forms extension for Joomla

Priority LOW 39

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the atta…

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.0033 Published 2026-09-29 No fix listed CWE-79
TI-2026-47660 CVE-2026-67364 · GHSA-m4fm-3x35-xqfq

Code injection in Balbooa Forms extension for Joomla

Priority MEDIUM 49

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval().

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00497 Published 2026-08-19 No fix listed CWE-94
TI-2026-46929 CVE-2026-65888 · GHSA-84gf-cfmw-8qqq

Improper access control in Balbooa Gridbox extension for Joomla

Priority MEDIUM 49

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00517 Published 2026-07-29 No fix listed CWE-284
TI-2026-46928 CVE-2026-65887 · GHSA-f53f-94jh-jchq

Improper access control in Balbooa Gridbox extension for Joomla

Priority MEDIUM 49

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding supe…

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00517 Published 2026-07-29 No fix listed CWE-284
TI-2026-46927 CVE-2026-65886 · GHSA-jc3g-m4mj-mm5m

Path traversal in Balbooa Gridbox extension for Joomla

Priority MEDIUM 46

Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00552 Published 2026-07-29 No fix listed CWE-22
TI-2026-46931 CVE-2026-65890 · GHSA-729v-8mm2-88pw

SQL injection in Balbooa Gridbox extension for Joomla

Priority MEDIUM 46

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00502 Published 2026-07-29 No fix listed CWE-89
TI-2026-46925 CVE-2026-65884 · GHSA-5mfv-p7rj-5xgx

Improper access control in Balbooa Gridbox extension for Joomla

Priority MEDIUM 49

Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permis…

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00517 Published 2026-07-29 No fix listed CWE-284
Load more