Phil Taylor

**Name of the Vulnerable Software and Affected Versions** Cotton Cloud versions prior to 2.0.3 **Description** An improper Access Control List (ACL) implementation allows authenticated users to perform unauthorized file operations on files owned by other users. These operations include reading, deleting, overwriting, and re-assigning permissions. **Recommendations** Update Cotton Cloud to version 2.0.3 or later.

**Name of the Vulnerable Software and Affected Versions** Cotton Cloud versions prior to 2.0.2 **Description** An improper Access Control List (ACL) implementation allows unauthenticated users to perform unauthorized file operations on every file managed within the extension. These operations include reading, deleting, overwriting, and re-assigning permissions. **Recommendations** Update to version 2.0.2 or later.

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files.

Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.

Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories.

**Name of the Vulnerable Software and Affected Versions** Gridbox versions prior to 2.20.2 **Description** A privilege escalation issue exists in the registration method of the Gridbox extension for Joomla. This flaw allows unauthenticated actors to register new accounts with administrative permissions by providing specific usergroup IDs. **Recommendations** Update Gridbox to version 2.20.2 or later.

**Name of the Vulnerable Software and Affected Versions** Gridbox versions prior to 2.20.2 **Description** An issue exists in the `resetPassword()` method that allows unauthenticated actors to reset the password of any user, enabling them to log in and perform actions as those users, with the exception of super administrators. **Recommendations** Update Gridbox to version 2.20.2 or later. As a temporary workaround, restrict access to the `resetPassword()` method until the update is applied.

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2

**Name of the Vulnerable Software and Affected Versions** Gridbox versions prior to 2.20.2 **Description** An account takeover issue exists in the `socialLogin()` method, which allows an attacker to authenticate as any user on the target site. **Recommendations** Update Gridbox to version 2.20.2 or later. As a temporary workaround, restrict access to the `socialLogin()` method until the update is applied.

**Name of the Vulnerable Software and Affected Versions** SP Page Builder versions prior to 6.7.1 **Description** A hardcoded, product-wide secret allows unauthenticated attackers to perform mail relay by forging the mail from address of forms. **Recommendations** Update SP Page Builder to version 6.7.1 or later.

**Name of the Vulnerable Software and Affected Versions** SP Page Builder versions prior to 6.7.1 **Description** Authenticated users can exploit an SQL injection issue caused by improper validation of parameters within the media manager search and date filters. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update SP Page Builder to version 6.7.1 or later.

**Name of the Vulnerable Software and Affected Versions** SP Page Builder versions prior to 6.7.1 **Description** Improper validation of order parameters in the Dynamic Content endpoint allows for an unauthenticated SQL injection. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update SP Page Builder to version 6.7.1 or later.

**Name of the Vulnerable Software and Affected Versions** SP Page Builder versions prior to 6.7.1 **Description** Improper path validation and Access Control List (ACL) checks in the media manager allow an authenticated user to perform arbitrary file deletion. **Recommendations** Update SP Page Builder to version 6.7.1 or later.

**Name of the Vulnerable Software and Affected Versions** Easy Store versions 1.0.0 through 2.0.1 **Description** Improper validation of order parameters allows an unauthenticated SQL injection, which is a technique used to manipulate database queries. This issue enables full read access to the database, including sensitive information such as credentials and sessions. **Recommendations** Update Easy Store to a version later than 2.0.1.

**Name of the Vulnerable Software and Affected Versions** Easy Store versions 1.0.0 through 2.0.1 **Description** An issue exists where critical order and payment information, including states, are processed from client-side input. This allows unauthenticated attackers to manipulate the payment and order states of arbitrary orders. **Recommendations** Update Easy Store to a version later than 2.0.1.

**Name of the Vulnerable Software and Affected Versions** Easy Store versions 1.0.0 through 2.0.1 **Description** Improper access checks allow logged-in users to retrieve order and personal customer information for any order within the system. **Recommendations** Update Easy Store to a version later than 2.0.1.