Vulnerabilidades do Balbooa Gridbox
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Balbooa Gridbox: 11 registro(s), com versões afetadas e correções.cpe:2.3:a:balbooa:gridbox
CVE-2026-65947
Alta · 7.3
CWE-352 29/07/2026
Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2
Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2
CVE-2026-65888
Crítica · 9.8
CWE-284 29/07/2026
Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2
Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.
CVE-2026-65887
Crítica · 9.8
CWE-284 29/07/2026
Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2
Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins.
CVE-2026-65886
Alta · 7.5
CWE-22 29/07/2026
Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2
Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files.
CVE-2026-66490
Média · 6.1
CWE-79 29/07/2026
Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2
Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2
CVE-2026-66489
Média · 5.3
CWE-200 29/07/2026
Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2
Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2
CVE-2026-66488
Média · 5.3
CWE-285 29/07/2026
Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2
Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2
CVE-2026-65890
Crítica · 9.8
CWE-89 29/07/2026
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.
CVE-2026-65889
Alta · 7.5
CWE-22 29/07/2026
Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2
Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories.
CVE-2026-65885
Alta · 8.8
CWE-434 29/07/2026
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.
CVE-2026-65884
Crítica · 9.8
CWE-284 29/07/2026
Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2
Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions.