CVE-2026-65947

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox 2.20.2...

CVE-2026-65888

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox 2.20.2 - The socialLogin method allows actors to login as any given user on the target site...

CVE-2026-65887

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins...

CVE-2026-65886

Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files...

CVE-2026-66490

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox 2.20.2...

CVE-2026-66488

Joomla Extension - balbooa.com - Payment bypass in Gridbox 2.20.2...

CVE-2026-66489

Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox 2.20.2...

CVE-2026-65890

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries...

CVE-2026-65947 Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox 2.20.2...

CVE-2026-65947 Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox 2.20.2...

EUVD-2026-50357

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox 2.20.2...

CVE-2026-65947

CVE-2026-65947 affects the Joomla extension Gridbox (balbooa.com) prior to version 2.20.2, with multiple CSRF vectors in the admin interface. The exposed issue arises from CSRF weaknesses in Gridbox’s admin area, leading to potential unauthorized actions authenticated sessions could perform. The ...

EUVD-2026-50356

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox 2.20.2 - The socialLogin method allows actors to login as any given user on the target site...

CVE-2026-65888 Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox 2.20.2 - The socialLogin method allows actors to login as any given user on the target site...

CVE-2026-65888 Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox 2.20.2 - The socialLogin method allows actors to login as any given user on the target site...

CVE-2026-65888

The CVE concerns Joomla extension Gridbox by balbooa.com, with versions older than 2.20.2. The underlying issue is a vulnerability in the socialLogin method that can allow an attacker to log in as any user on the target site, i.e., an account takeover. The CVSS 4.0 score is 10.0 (CRITICAL) with n...

CVE-2026-65887 Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins...

CVE-2026-65887

CVE-2026-65887 affects the Joomla Extension Gridbox by balbooa.com (versions earlier than 2.20.2). The vulnerability arises from an insecure resetPassword function that allows unauthenticated actors to reset any user password (excluding super admins), enabling login as those users and performing ...

EUVD-2026-50355

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins...

CVE-2026-65887 Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins...