Skip to content
COOEY

FAIL › dossier

Balbooa

VENDOR

· dossier confidence 50%

Balbooa is a vendor with a critical security posture, evidenced by two confirmed RCE vulnerabilities in July 2026 involving unauthenticated file uploads in their Forms extension.

Failure events
8
Zero-days
1
RCEs
2
On KEV
1
Critical
7
Worst shame
85
PROFILE
CategoryvendorWhat they doBalbooa is a vendor providing software components, specifically a Forms extension, for enterprise applications.
SECURITY POSTURE

Critical security posture with two confirmed RCE vulnerabilities in July 2026 involving unauthenticated file uploads.

Notable failures
  • CVE-2026-56291: Unauthenticated arbitrary file upload leading to full RCE
  • CVE-2026-56291: Balbooa Forms extension enables unauthenticated RCE via arbitrary file upload
  • High severity RCE in Balbooa Forms
Patterns: Repeated unpatched edge-device RCEs
FAILURE HISTORY · 8
DATEEVENTSEVSUMMARY
2026-09-29 CVE-2026-102425 critical Unauthenticated remote code execution in Balbooa Forms allows attackers to execute arbitrary PHP code via shortcode injection.
2026-07-29 CVE-2026-65884 critical Unauthenticated actors can register new Joomla admin accounts via a flawed registration method in Gridbox < 2.20.2.
2026-07-10 CVE-2026-56291 high Balbooa Forms allows unauthenticated arbitrary file upload leading to full RCE.
2026-07-09 CVE-2026-56291 critical Balbooa Forms extension enables unauthenticated RCE via arbitrary file upload.
2026-07-29 CVE-2026-65888 critical CVE-2026-65888 allows attackers to take over any user account on Joomla sites using the Gridbox extension via the socialLogin method.
2026-07-29 CVE-2026-65890 critical Unauthenticated SQL injection in Balbooa's Gridbox Joomla extension allows attackers to extract or modify database contents without authentication.
2026-09-29 CVE-2026-101127 critical Balbooa Forms extension allows unauthenticated stored XSS via malicious filenames in uploaded attachments.
2026-07-29 CVE-2026-65887 critical Unauthenticated password reset in Gridbox Joomla extension allows attackers to compromise user accounts.
DOSSIER SOURCES
Open questions: Balbooa's corporate identity and ownership structure · Balbooa's founding date and headquarters location · Balbooa's employee count and market size
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-07-14 04:03:05.940671+00:00