Vulnerability · Published Oct 27, 2026 · Assigned by Joomla

CVE-2026-102788Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2

Critical 9.3

In plain English

A critical-severity SQL injection in Gridbox extension for Joomla from balbooa.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.4%top 67.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist

Affected products (as reported)

Vendor	Product	Versions
balbooa.com	Gridbox extension for Joomla	1.0.0-2.20.4.1

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.balbooa.com/gridbox product