Balbooa.com vulnerabilities
We track 19 vulnerabilities in Balbooa.com products across 4 products. 19 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on October 27, 2026.
Latest Balbooa.com vulnerabilities
- 9.3 Critical severity
Gridbox extension for Joomla: Improper Access Control
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHe
- 9.3 Critical severity
Gridbox extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the paramet
- 8.7 High severity
Gridbox extension for Joomla: Cross-Site Request Forgery
Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads ur
- 10.0 Critical severity
Balbooa Forms extension for Joomla: Improper Control of Generation of Code
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes ins
- 7.5 High severity
Balbooa Forms extension for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every objec
- 9.4 Critical severity
Balbooa Forms extension for Joomla: Improper Neutralization of Input During Web Page Generation
Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filenam
- 10.0 Critical severity
Balbooa Forms extension for Joomla: Improper Control of Generation of Code
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval(). The [URL parameter = X] shortcode is substituted with the raw, unescaped value of a query p
- 7.7 High severity
Balbooa Forms extension for Joomla: External Control of Assumed-Immutable Web Parameter
Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomp
- 9.8 Critical severity
Gridbox extension for Joomla: Improper Access Control
Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.
- 9.8 Critical severity
Gridbox extension for Joomla: Improper Access Control
Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins.
- 7.5 High severity
Gridbox extension for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files.
- 9.8 Critical severity
Gridbox extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.
- 7.5 High severity
Gridbox extension for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories.
- 8.8 High severity
Gridbox extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can
- 9.8 Critical severity
Gridbox extension for Joomla: Improper Access Control
Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions.
- 10.0 Critical severity
Balbooa Forms component for Joomla: Improper Control of Generation of Code
Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An insecure form processing logic allowed code execution for forms that include the signature field type.
- 9.4 Critical severity
Gridbox extension for Joomla: Authentication Bypass Using an Alternate Path or Channel
Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access.
- 9.8 Critical severity
Balbooa Forms Unrestricted Upload of File with Dangerous Type Exploited
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
- 8.6 High severity
Balbooa Forms component for Joomla: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in the Balbooa Forms plugin 1.0.0-2.3.1.1 for Joomla allows privileged users to execute arbitrary SQL commands via the 'id' parameter.