Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (14 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-102784 1 Balbooa.com 1 Gridbox Extension For Joomla 2026-10-08 N/A
Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request input. A GET request can therefore reach the action without the trait checking a token. The action still requires core.tools , but that is the victim’s permission check; it does not prove that the privileged user intended the request.
CVE-2026-102783 1 Balbooa.com 1 Gridbox Extension For Joomla 2026-10-08 N/A
Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then returns the image. If image decoding is unavailable or fails, the action streams the file directly. An existing image in a sibling directory such as images-backup can therefore satisfy the current containment test even though it is outside the configured images root. The route restricts the file extension to Gridbox image types, which materially limits the read primitive. The default media root is images ; the effective site setting was not independently verified. No prefix-matching sibling directory was found alongside the site’s images directory. The finding is rated Low rather than presented as arbitrary file disclosure.
CVE-2026-65887 2 Balbooa, Balbooa.com 2 Gridbox, Gridbox Extension For Joomla 2026-07-31 9.8 Critical
Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins.
CVE-2026-65888 2 Balbooa, Balbooa.com 2 Gridbox, Gridbox Extension For Joomla 2026-07-31 9.8 Critical
Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.
CVE-2026-66489 2 Balbooa, Balbooa.com 2 Gridbox, Gridbox Extension For Joomla 2026-07-30 5.3 Medium
Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2
CVE-2026-65947 2 Balbooa, Balbooa.com 2 Gridbox, Gridbox Extension For Joomla 2026-07-30 7.3 High
Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2
CVE-2026-66488 2 Balbooa, Balbooa.com 2 Gridbox, Gridbox Extension For Joomla 2026-07-30 5.3 Medium
Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2
CVE-2026-65886 2 Balbooa, Balbooa.com 2 Gridbox, Gridbox Extension For Joomla 2026-07-29 7.5 High
Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files.
CVE-2026-66490 2 Balbooa, Balbooa.com 2 Gridbox, Gridbox Extension For Joomla 2026-07-29 6.1 Medium
Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2
CVE-2026-65889 2 Balbooa, Balbooa.com 2 Gridbox, Gridbox Extension For Joomla 2026-07-29 7.5 High
Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories.
CVE-2026-65890 2 Balbooa, Balbooa.com 2 Gridbox, Gridbox Extension For Joomla 2026-07-29 9.8 Critical
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.
CVE-2026-65885 2 Balbooa, Balbooa.com 2 Gridbox, Gridbox Extension For Joomla 2026-07-29 8.8 High
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.
CVE-2026-65884 2 Balbooa, Balbooa.com 2 Gridbox, Gridbox Extension For Joomla 2026-07-29 9.8 Critical
Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions.
CVE-2026-61425 1 Balbooa.com 1 Gridbox Extension For Joomla 2026-07-23 N/A
Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access.