Vulnerability Intelligence Report
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2
CVE-2026-102788
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist
Injection
No Active Exploit Signals
CVSS Base Score
9.3
CRITICAL
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-89 ↗CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| balbooa.com | Gridbox extension for Joomla | 1.0.0-2.20.4.1 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
GitHub Advisory
Vulnerability Class
Injection
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Joomla! Project · Vendor · USA |
| Reserved | 2026-09-29T16:46:15 |
| Published | 2026-10-27T09:30:08 |
| Last Updated | 2026-10-27T09:30:08 |
Community Chatter & Buzz