CVE-2026-102788
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist
| CWE | CWE-89 |
| Vendor | balbooa.com |
| Product | gridbox extension for joomla |
| Published | Oct 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for balbooa.com gridbox extension for joomla
Be the first to know when new unknown vulnerabilities affecting balbooa.com gridbox extension for joomla are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
balbooa.com / Gridbox extension for Joomla
1.0.0-2.20.4.1
Credits
Artur Błażewicz