{"schema_version":1,"title":"Balbooa Gridbox vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 12 vulnerabilities in Balbooa Gridbox: 0 in the last 7 days and 12 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-65947, was published on 29 July 2026.","url":"https://junglewise.ai/threats/technologies/gridbox","json_url":"https://junglewise.ai/threats/technologies/gridbox.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/gridbox","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":0,"all_time":12,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":12,"last_365_days":12},"latest":[{"cve":"CVE-2026-65947","cvss":0,"slug":"cve-2026-65947-balbooa-gridbox-csrf-in-administrative-interface","title":"Balbooa Gridbox CSRF in administrative interface","severity":"info","exploited":false,"published_at":"2026-07-29T15:16:29.5+00:00","url":"https://junglewise.ai/threats/cve-2026-65947-balbooa-gridbox-csrf-in-administrative-interface"},{"cve":"CVE-2026-65888","cvss":10,"slug":"cve-2026-65888-balbooa-gridbox-account-takeover-via-sociallogin-method","title":"Balbooa Gridbox account takeover via socialLogin method","severity":"info","exploited":false,"published_at":"2026-07-29T15:16:28.813+00:00","url":"https://junglewise.ai/threats/cve-2026-65888-balbooa-gridbox-account-takeover-via-sociallogin-method"},{"cve":"CVE-2026-65887","cvss":10,"slug":"cve-2026-65887-balbooa-gridbox-unauthenticated-arbitrary-password-reset","title":"Balbooa Gridbox unauthenticated arbitrary password reset","severity":"info","exploited":false,"published_at":"2026-07-29T15:16:28.613+00:00","url":"https://junglewise.ai/threats/cve-2026-65887-balbooa-gridbox-unauthenticated-arbitrary-password-reset"},{"cve":"CVE-2026-65886","cvss":9.2,"slug":"cve-2026-65886-balbooa-gridbox-for-joomla-unauthenticated-arbitrary-file-read-in","title":"Balbooa Gridbox for Joomla unauthenticated arbitrary file read in photo viewer","severity":"info","exploited":false,"published_at":"2026-07-29T15:16:28.467+00:00","url":"https://junglewise.ai/threats/cve-2026-65886-balbooa-gridbox-for-joomla-unauthenticated-arbitrary-file-read-in"},{"cve":"CVE-2026-66490","cvss":6.1,"slug":"cve-2026-66490-balbooa-gridbox-stored-xss-in-comment-avatar","title":"Balbooa Gridbox stored XSS in comment avatar","severity":"info","exploited":false,"published_at":"2026-07-29T14:16:34.373+00:00","url":"https://junglewise.ai/threats/cve-2026-66490-balbooa-gridbox-stored-xss-in-comment-avatar"},{"cve":"CVE-2026-66489","cvss":5.3,"slug":"cve-2026-66489-balbooa-gridbox-unauthenticated-file-system-disclosure","title":"Balbooa Gridbox unauthenticated file system disclosure","severity":"info","exploited":false,"published_at":"2026-07-29T14:16:34.27+00:00","url":"https://junglewise.ai/threats/cve-2026-66489-balbooa-gridbox-unauthenticated-file-system-disclosure"},{"cve":"CVE-2026-66488","cvss":7.5,"slug":"cve-2026-66488-balbooa-gridbox-payment-bypass-in-joomla-extension","title":"Balbooa Gridbox payment bypass in Joomla extension","severity":"info","exploited":false,"published_at":"2026-07-29T14:16:34.167+00:00","url":"https://junglewise.ai/threats/cve-2026-66488-balbooa-gridbox-payment-bypass-in-joomla-extension"},{"cve":"CVE-2026-65890","cvss":9.2,"slug":"cve-2026-65890-balbooa-gridbox-for-joomla-unauthenticated-sql-injection","title":"Balbooa Gridbox for Joomla unauthenticated SQL injection","severity":"info","exploited":false,"published_at":"2026-07-29T14:16:33.883+00:00","url":"https://junglewise.ai/threats/cve-2026-65890-balbooa-gridbox-for-joomla-unauthenticated-sql-injection"},{"cve":"CVE-2026-65889","cvss":9.2,"slug":"cve-2026-65889-balbooa-gridbox-for-joomla-unauthenticated-recursive-directory","title":"Balbooa Gridbox for Joomla unauthenticated recursive directory deletion","severity":"info","exploited":false,"published_at":"2026-07-29T14:16:33.757+00:00","url":"https://junglewise.ai/threats/cve-2026-65889-balbooa-gridbox-for-joomla-unauthenticated-recursive-directory"},{"cve":"CVE-2026-65885","cvss":9.4,"slug":"cve-2026-65885-balbooa-gridbox-for-joomla-authenticated-arbitrary-file-upload","title":"Balbooa Gridbox for Joomla authenticated arbitrary file upload","severity":"info","exploited":false,"published_at":"2026-07-29T13:19:10.82+00:00","url":"https://junglewise.ai/threats/cve-2026-65885-balbooa-gridbox-for-joomla-authenticated-arbitrary-file-upload"},{"cve":"CVE-2026-65884","cvss":10,"slug":"cve-2026-65884-balbooa-gridbox-privilege-escalation-in-registration-method","title":"Balbooa Gridbox privilege escalation in registration method","severity":"info","exploited":false,"published_at":"2026-07-29T13:19:10.677+00:00","url":"https://junglewise.ai/threats/cve-2026-65884-balbooa-gridbox-privilege-escalation-in-registration-method"},{"cve":"CVE-2026-61425","cvss":9.4,"slug":"cve-2026-61425-balbooa-gridbox-for-joomla-authentication-bypass-in-super-user","title":"Balbooa Gridbox for Joomla authentication bypass in Super User login","severity":"info","exploited":false,"published_at":"2026-07-20T19:17:28.15+00:00","url":"https://junglewise.ai/threats/cve-2026-61425-balbooa-gridbox-for-joomla-authentication-bypass-in-super-user"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":11},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Balbooa Gridbox","slug":"gridbox","vendor":{"name":"Balbooa","slug":"balbooa","url":"https://junglewise.ai/threats/vendors/balbooa"},"aliases":[],"category":"library","homepage":"https://www.balbooa.com/joomla-extensions/gridbox","description":"Gridbox is a website builder and design framework for the Joomla content management system.","url":"https://junglewise.ai/threats/technologies/gridbox"},"most_severe":[{"cve":"CVE-2026-65888","cvss":10,"slug":"cve-2026-65888-balbooa-gridbox-account-takeover-via-sociallogin-method","title":"Balbooa Gridbox account takeover via socialLogin method","severity":"info","exploited":false,"published_at":"2026-07-29T15:16:28.813+00:00","url":"https://junglewise.ai/threats/cve-2026-65888-balbooa-gridbox-account-takeover-via-sociallogin-method"},{"cve":"CVE-2026-65887","cvss":10,"slug":"cve-2026-65887-balbooa-gridbox-unauthenticated-arbitrary-password-reset","title":"Balbooa Gridbox unauthenticated arbitrary password reset","severity":"info","exploited":false,"published_at":"2026-07-29T15:16:28.613+00:00","url":"https://junglewise.ai/threats/cve-2026-65887-balbooa-gridbox-unauthenticated-arbitrary-password-reset"},{"cve":"CVE-2026-65884","cvss":10,"slug":"cve-2026-65884-balbooa-gridbox-privilege-escalation-in-registration-method","title":"Balbooa Gridbox privilege escalation in registration method","severity":"info","exploited":false,"published_at":"2026-07-29T13:19:10.677+00:00","url":"https://junglewise.ai/threats/cve-2026-65884-balbooa-gridbox-privilege-escalation-in-registration-method"},{"cve":"CVE-2026-65885","cvss":9.4,"slug":"cve-2026-65885-balbooa-gridbox-for-joomla-authenticated-arbitrary-file-upload","title":"Balbooa Gridbox for Joomla authenticated arbitrary file upload","severity":"info","exploited":false,"published_at":"2026-07-29T13:19:10.82+00:00","url":"https://junglewise.ai/threats/cve-2026-65885-balbooa-gridbox-for-joomla-authenticated-arbitrary-file-upload"},{"cve":"CVE-2026-61425","cvss":9.4,"slug":"cve-2026-61425-balbooa-gridbox-for-joomla-authentication-bypass-in-super-user","title":"Balbooa Gridbox for Joomla authentication bypass in Super User login","severity":"info","exploited":false,"published_at":"2026-07-20T19:17:28.15+00:00","url":"https://junglewise.ai/threats/cve-2026-61425-balbooa-gridbox-for-joomla-authentication-bypass-in-super-user"},{"cve":"CVE-2026-65886","cvss":9.2,"slug":"cve-2026-65886-balbooa-gridbox-for-joomla-unauthenticated-arbitrary-file-read-in","title":"Balbooa Gridbox for Joomla unauthenticated arbitrary file read in photo viewer","severity":"info","exploited":false,"published_at":"2026-07-29T15:16:28.467+00:00","url":"https://junglewise.ai/threats/cve-2026-65886-balbooa-gridbox-for-joomla-unauthenticated-arbitrary-file-read-in"},{"cve":"CVE-2026-65890","cvss":9.2,"slug":"cve-2026-65890-balbooa-gridbox-for-joomla-unauthenticated-sql-injection","title":"Balbooa Gridbox for Joomla unauthenticated SQL injection","severity":"info","exploited":false,"published_at":"2026-07-29T14:16:33.883+00:00","url":"https://junglewise.ai/threats/cve-2026-65890-balbooa-gridbox-for-joomla-unauthenticated-sql-injection"},{"cve":"CVE-2026-65889","cvss":9.2,"slug":"cve-2026-65889-balbooa-gridbox-for-joomla-unauthenticated-recursive-directory","title":"Balbooa Gridbox for Joomla unauthenticated recursive directory deletion","severity":"info","exploited":false,"published_at":"2026-07-29T14:16:33.757+00:00","url":"https://junglewise.ai/threats/cve-2026-65889-balbooa-gridbox-for-joomla-unauthenticated-recursive-directory"},{"cve":"CVE-2026-66488","cvss":7.5,"slug":"cve-2026-66488-balbooa-gridbox-payment-bypass-in-joomla-extension","title":"Balbooa Gridbox payment bypass in Joomla extension","severity":"info","exploited":false,"published_at":"2026-07-29T14:16:34.167+00:00","url":"https://junglewise.ai/threats/cve-2026-66488-balbooa-gridbox-payment-bypass-in-joomla-extension"},{"cve":"CVE-2026-66490","cvss":6.1,"slug":"cve-2026-66490-balbooa-gridbox-stored-xss-in-comment-avatar","title":"Balbooa Gridbox stored XSS in comment avatar","severity":"info","exploited":false,"published_at":"2026-07-29T14:16:34.373+00:00","url":"https://junglewise.ai/threats/cve-2026-66490-balbooa-gridbox-stored-xss-in-comment-avatar"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}