balbooa security advisories
7 threat alerts tracking vulnerabilities and security advisories that affect balbooa products.
Vulnios monitors balbooa CVE feeds, vendor advisories, CISA KEV listings, and exploit-prediction data continuously. Each alert below is enriched with severity, exploitation status, affected products, and a remediation path. Use this page to scan recent balbooa security news in one place, or click into an individual alert for full detail.
Critical Vulnerability: CVE-2026-101127 — balbooa — forms
Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type,
criticalCVE-2026-101127Critical Vulnerability: CVE-2026-102425 — balbooa — forms
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form sub
criticalCVE-2026-102425Critical Vulnerability: CVE-2026-65884 — balbooa — gridbox
Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with a
criticalCVE-2026-65884Critical Vulnerability: CVE-2026-65887 — balbooa — gridbox
Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these us
criticalCVE-2026-65887Critical Vulnerability: CVE-2026-65888 — balbooa — gridbox
Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.
criticalCVE-2026-65888Critical Vulnerability: CVE-2026-65890 — balbooa — gridbox
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.
criticalCVE-2026-65890Critical Vulnerability: CVE-2026-56291 — balbooa — forms
The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
criticalCVE-2026-56291
Track balbooa exposure across your environment
Vulnios automatically cross-references your asset inventory against new balbooa CVEs and surfaces only what affects you. No more sifting manually — actionable findings only.
Start a free scan