Security releases
Researcher credits in vendor advisories
Vendors name researchers in their own advisories. Find your line and claim it. It counts on your profile right away and gets a BugRater ID you can quote.
Vendor
-
Balbooa.com CVE-2026-107903
Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0
0 CVEs and 0 credit lines.
-
Balbooa.com CVE-2026-107130
Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0
0 CVEs and 0 credit lines.
-
Balbooa.com CVE-2026-107129
Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0
0 CVEs and 0 credit lines.
-
Balbooa.com CVE-2026-105607
Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0
0 CVEs and 0 credit lines.
-
Balbooa.com CVE-2026-102789
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Balbooa.com CVE-2026-102788
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is re
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit