Skip to content
OpenAdvisories

Vendor

balbooa.com

31 known vulnerabilities.

Products

Gridbox extension for Joomla 20 Balbooa Forms extension for Joomla 7 Balbooa Forms component for Joomla 2 balbooa.com Balbooa Forms extension for Joomla 1 Balbooa Gallery component for Joomla 1
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 8.3
    CVE-2026-107129

    Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0

    Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0

    balbooa.com Gridbox extension for Joomla Web / CMS
  • High 8.6
    CVE-2026-107903

    Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0

    Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0

    balbooa.com Gridbox extension for Joomla Web / CMS
  • High 8.6
    CVE-2026-105607

    Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0

    Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0

    balbooa.com Gridbox extension for Joomla Web / CMS
  • High 8.7
    CVE-2026-102784

    Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0

    Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads u…

    balbooa.com Gridbox extension for Joomla Web / CMS
  • High 8.9
    CVE-2026-102424

    Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4

    Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every obje…

    balbooa.com Balbooa Forms extension for Joomla Web / CMS
  • High 8.6
    CVE-2026-101127

    Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4

    Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filena…

    balbooa.com Balbooa Forms extension for Joomla Web / CMS
  • High 7.7
    CVE-2026-67363 Public exploit

    Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2

    Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recom…

    balbooa.com Balbooa Forms extension for Joomla Web / CMS
  • High 7.3
    CVE-2026-65947

    Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2

    Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2

    balbooa.com Gridbox extension for Joomla Web / CMS
  • High 8.6
    CVE-2025-49485

    Extension - balbooa.com - SQL injection in Balbooa Forms component version 1.0.0 - 2.3.1.1 for Joomla

    A SQL injection vulnerability in the Balbooa Forms plugin 1.0.0-2.3.1.1 for Joomla allows privileged users to execute arbitrary SQL commands via the 'id' parameter.

    balbooa.com Balbooa Forms component for Joomla Web / CMS
  • High 8.6
    CVE-2025-49486

    Extension - balbooa.com - Stored XSS in Balbooa Gallery component version 1.0.0 - 2.4.0 for Joomla

    A stored XSS vulnerability in the Balbooa Gallery plugin 1.0.0-2.4.0 for Joomla allows privileged users to store malicious scripts in gallery items.

    balbooa.com Balbooa Gallery component for Joomla Web / CMS