Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-102788: Gridbox Joomla extension can be tricked into exposing data
CVE-2026-102788 · published today
Summary
The Gridbox extension for Joomla lets anyone modify a URL parameter on product list pages, causing the system to run unauthorized database commands. This could allow attackers to view or alter information stored in the site’s database. Update Gridbox to version 2.20.4.2 or later to fix the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| balbooa.com | gridbox extension for joomla | 1.0.0-2.20.4.1 |
Original advisory text
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist
References
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-89SQL Injection
Timeline
Published27 Oct 2026
Updated27 Oct 2026
First seen27 Oct 2026
Track software like this
Free during beta