Phil Taylor

Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.

Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files.

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.

Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories.

Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions.

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins.

**Name of the Vulnerable Software and Affected Versions** SP Page Builder versions prior to 6.7.1 **Description** A hardcoded, product-wide secret allows unauthenticated attackers to perform mail relay by forging the mail from address of forms. **Recommendations** Update SP Page Builder to version 6.7.1 or later.

**Name of the Vulnerable Software and Affected Versions** SP Page Builder versions prior to 6.7.1 **Description** Authenticated users can exploit an SQL injection issue caused by improper validation of parameters within the media manager search and date filters. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update SP Page Builder to version 6.7.1 or later.

**Name of the Vulnerable Software and Affected Versions** SP Page Builder versions prior to 6.7.1 **Description** Improper validation of order parameters in the Dynamic Content endpoint allows for an unauthenticated SQL injection. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update SP Page Builder to version 6.7.1 or later.

**Name of the Vulnerable Software and Affected Versions** SP Page Builder versions prior to 6.7.1 **Description** Improper path validation and Access Control List (ACL) checks in the media manager allow an authenticated user to perform arbitrary file deletion. **Recommendations** Update SP Page Builder to version 6.7.1 or later.

**Name of the Vulnerable Software and Affected Versions** Easy Store versions 1.0.0 through 2.0.1 **Description** Improper validation of order parameters allows an unauthenticated SQL injection, which is a technique used to manipulate database queries. This issue enables full read access to the database, including sensitive information such as credentials and sessions. **Recommendations** Update Easy Store to a version later than 2.0.1.

**Name of the Vulnerable Software and Affected Versions** Easy Store versions 1.0.0 through 2.0.1 **Description** An issue exists where critical order and payment information, including states, are processed from client-side input. This allows unauthenticated attackers to manipulate the payment and order states of arbitrary orders. **Recommendations** Update Easy Store to a version later than 2.0.1.

**Name of the Vulnerable Software and Affected Versions** Easy Store versions 1.0.0 through 2.0.1 **Description** Improper access checks allow logged-in users to retrieve order and personal customer information for any order within the system. **Recommendations** Update Easy Store to a version later than 2.0.1.

**Name of the Vulnerable Software and Affected Versions** Events Booking versions 5.0.0 through 5.8.1 **Description** An incorrect Access Control List (ACL) check—a mechanism used to define permissions for users—allows an actor to download invoice information without proper verification of their authorization. **Recommendations** Update Events Booking to version 5.8.1 or later.

**Name of the Vulnerable Software and Affected Versions** Page Builder CK versions prior to 3.6.2 **Description** An improper access control issue allows authenticated users to perform an arbitrary file upload, which can lead to Remote Code Execution (RCE), a state where an attacker can execute arbitrary commands on the host machine. **Recommendations** Update Page Builder CK to version 3.6.2 or later.