Balbooa.Com
Vulnerability activity for Balbooa.Com: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 8
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 8
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 8
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 8.3HighNov 5, 2026Balbooa.Com Gridbox extension for Joomla XSSCVE-2026-107903Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0
- 6.9MediumNov 5, 2026Balbooa.Com Gridbox extension for Joomla Auth bypass / access controlCVE-2026-107130Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0
- 5.5MediumNov 5, 2026Balbooa.Com Gridbox extension for Joomla Path traversal / file handlingCVE-2026-107129Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0
- 8.3HighNov 5, 2026Balbooa.Com Gridbox extension for Joomla XSSCVE-2026-105607Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0
- 9.3CriticalOct 27, 2026Balbooa.Com Gridbox extension for Joomla Auth bypass / access controlCVE-2026-102789Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel() check.
- 9.3CriticalOct 27, 2026Balbooa.Com Gridbox extension for Joomla SQL injectionCVE-2026-102788Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist
- 8.7HighOct 8, 2026Balbooa.Com Gridbox extension for Joomla CSRFCVE-2026-102784Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request input. A GET request can therefore reach the action without the trait checking a token. The action still requires core.tools , but that is the victim’s permission check; it does not prove that the privi
- 6.3MediumOct 8, 2026Balbooa.Com Gridbox extension for Joomla Path traversal / file handlingCVE-2026-102783Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then returns the image. If image decoding is unavailable or fails, the action streams the file directly. An existing image in a sibling directory such as images-backup can therefore satisfy the current containment test even though it is outside the
Top products
- Gridbox extension for Joomla8 CVEs in the last year, 2 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.