# cve.now: Balbooa.com

The newest entries naming Balbooa.com as an affected vendor (up to 200), of 31 in all, 1 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-107129](https://cve.now/CVE-2026-107129.md): Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox \< 2.20.5.0 (CVSS 8.3)
- [CVE-2026-107130](https://cve.now/CVE-2026-107130.md): Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox \< 2.20.5.0 (CVSS 6.9)
- [CVE-2026-107903](https://cve.now/CVE-2026-107903.md): Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox \< 2.20.5.0 (CVSS 8.6)
- [CVE-2026-105607](https://cve.now/CVE-2026-105607.md): Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox \< 2.20.5.0 (CVSS 8.6)
- [CVE-2026-102788](https://cve.now/CVE-2026-102788.md): Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox \< 2.20.4.2 (CVSS 9.3)
- [CVE-2026-102789](https://cve.now/CVE-2026-102789.md): Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox \< 2.20.4.2 (CVSS 9.3)
- [CVE-2026-102783](https://cve.now/CVE-2026-102783.md): Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox \< 2.20.4.0 (CVSS 6.3)
- [CVE-2026-102784](https://cve.now/CVE-2026-102784.md): Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox \< 2.20.4.0 (CVSS 8.7)
- [CVE-2026-102424](https://cve.now/CVE-2026-102424.md): Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms \< 2.4.3.4 (CVSS 8.9)
- [CVE-2026-102425](https://cve.now/CVE-2026-102425.md): Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms \< 2.4.3.4 (CVSS 9.5)
- [CVE-2026-101126](https://cve.now/CVE-2026-101126.md): Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms \< 2.4.3.4 (CVSS 6.9)
- [CVE-2026-101112](https://cve.now/CVE-2026-101112.md): Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms \< 2.4.3.4 (CVSS 6.9)
- [CVE-2026-101127](https://cve.now/CVE-2026-101127.md): Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms \< 2.4.3.4 (CVSS 8.6)
- [CVE-2026-67364](https://cve.now/CVE-2026-67364.md): Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms \< 2.4.3.2 (CVSS 10.0)
- [CVE-2026-67363](https://cve.now/CVE-2026-67363.md): Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms \< 2.4.3.2 (CVSS 7.7)
- [CVE-2026-65947](https://cve.now/CVE-2026-65947.md): Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox \< 2.20.2 (CVSS 7.3)
- [CVE-2026-65888](https://cve.now/CVE-2026-65888.md): Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox \< 2.20.2 (CVSS 10.0)
- [CVE-2026-65887](https://cve.now/CVE-2026-65887.md): Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox \< 2.20.2 (CVSS 10.0)
- [CVE-2026-65886](https://cve.now/CVE-2026-65886.md): Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox \< 2.20.2 (CVSS 9.2)
- [CVE-2026-65890](https://cve.now/CVE-2026-65890.md): Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox \< 2.20.2 (CVSS 9.2)
- [CVE-2026-66489](https://cve.now/CVE-2026-66489.md): Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox \< 2.20.2 (CVSS 5.3)
- [CVE-2026-66488](https://cve.now/CVE-2026-66488.md): Joomla Extension - balbooa.com - Payment bypass in Gridbox \< 2.20.2 (CVSS 5.3)
- [CVE-2026-65889](https://cve.now/CVE-2026-65889.md): Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox \< 2.20.2 (CVSS 9.2)
- [CVE-2026-66490](https://cve.now/CVE-2026-66490.md): Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox \< 2.20.2 (CVSS 6.1)
- [CVE-2026-65884](https://cve.now/CVE-2026-65884.md): Joomla Extension - balbooa.com - Privilege Escalation in Gridbox \< 2.20.2 (CVSS 10.0)
- [CVE-2026-65885](https://cve.now/CVE-2026-65885.md): Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox \< 2.20.2 (CVSS 9.4)
- [CVE-2026-65880](https://cve.now/CVE-2026-65880.md): Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms \< 2.4.3 (CVSS 10.0)
- [CVE-2026-61425](https://cve.now/CVE-2026-61425.md): Joomla Extension - balbooa.com - Authentication bypass in Gridbox \< 1.6.0 (CVSS 9.4)
- [CVE-2026-56291](https://cve.now/CVE-2026-56291.md): Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension \< 2.4.1 (CVSS 10.0, KEV)
- [CVE-2025-49485](https://cve.now/CVE-2025-49485.md): Extension - balbooa.com - SQL injection in Balbooa Forms component version 1.0.0 - 2.3.1.1 for Joomla (CVSS 8.6)
- [CVE-2025-49486](https://cve.now/CVE-2025-49486.md): Extension - balbooa.com - Stored XSS in Balbooa Gallery component version 1.0.0 - 2.4.0 for Joomla (CVSS 8.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/balbooa-com
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.