Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2

Description

Affected Products

Vendor	Product	Versions
balbooa.com	gridbox extension for joomla	1.0.0-2.20.1

References

https://www.balbooa.com/gridbox(product)
https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/(third-party-advisory)

Related News (1 articles)

Tier C

VulDB4h ago

CVE-2026-66490 | Balbooa Gridbox Extension up to 2.20.1 cross site scripting

→ No new info (linked only)

CVSS 3.16.1 MEDIUM

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA KEV❌ No

Actively exploited❌ No

CWECWE-79

PublishedJul 29, 2026

Trending Score23

Source articles1

Independent1

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

NONECVE-2026-65884EXPKEV

Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2

Trending: 102

NONECVE-2026-65885EXPKEV

Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2

Trending: 92

NONECVE-2026-65880

Joomla Extension - joomshaper.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3

Trending: 31

NONECVE-2026-65886

Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2

Trending: 30

NONECVE-2026-65889

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2

Trending: 30

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Jul 29, 2026

Discovered by ZDM

Jul 29, 2026