Balbooa Gridbox — known CVE vulnerabilities

Every CVE whose affected-product data names Balbooa Gridbox, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (12)

• CVE-2026-65890 — CVSS 9.8 (critical): Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to…
• CVE-2026-65884 — CVSS 9.8 (critical): Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs…
• CVE-2026-65887 — CVSS 9.8 (critical): Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to…
• CVE-2026-65888 — CVSS 9.8 (critical): Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any…
• CVE-2026-65885 — CVSS 8.8 (high): Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated…
• CVE-2026-65889 — CVSS 7.5 (high): Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to…
• CVE-2026-65886 — CVSS 7.5 (high): Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated…
• CVE-2026-65947 — CVSS 7.3 (high): Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2
• CVE-2026-66490 — CVSS 6.1 (medium): Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2
• CVE-2018-11690 — CVSS 6.1 (medium): The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is vulnerable to cross-site scripting, caused by improper…
• CVE-2026-66489 — CVSS 5.3 (medium): Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2
• CVE-2026-66488 — CVSS 5.3 (medium): Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2