balbooa.com vulnerabilities

CVEs per yearBy the year they were published

1. 20252
2. 202629

Known exploitedNewest addition to KEV first

• CVE-2026-56291

  Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1

  balbooa.com · balbooa.com Balbooa Forms extension for Joomla

  ExploitedCritical10.0

Newest CVEs

• CVE-2026-107129

  Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0

  balbooa.com · Gridbox extension for Joomla

  High8.3
• CVE-2026-107130

  Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0

  balbooa.com · Gridbox extension for Joomla

  Medium6.9
• CVE-2026-107903

  Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0

  balbooa.com · Gridbox extension for Joomla

  High8.6
• CVE-2026-105607

  Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0

  balbooa.com · Gridbox extension for Joomla

  High8.6
• CVE-2026-102788

  Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2

  balbooa.com · Gridbox extension for Joomla

  Critical9.3
• CVE-2026-102789

  Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2

  balbooa.com · Gridbox extension for Joomla

  Critical9.3
• CVE-2026-102783

  Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0

  balbooa.com · Gridbox extension for Joomla

  Medium6.3
• CVE-2026-102784

  Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0

  balbooa.com · Gridbox extension for Joomla

  High8.7
• CVE-2026-102424

  Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4

  balbooa.com · Balbooa Forms extension for Joomla

  High8.9
• CVE-2026-102425

  Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4

  balbooa.com · Balbooa Forms extension for Joomla

  Critical9.5