Live › vulnerability › CVE-2026-102788
Go to dashboardGridbox, a Joomla page-builder extension by balbooa.com, passes the sort-by URL parameter on store product list pages straight into an ORDER BY clause without an allowlist check. An unauthenticated remote attacker can inject SQL to read or change database contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 10:31 UTC. All times on this page are UTC.
Sites running the Gridbox Joomla extension below 2.20.4.2 that expose store product list pages to the public. Sites without Gridbox, or with it updated, are not affected.
No product ranges from the sources yet.
2.20.4.2com_gridbox) and whether store product list pages are published2.20.4.2 or later from balbooa.comEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist
This page as .md · .json · in your agent: get_signal("CVE-2026-102788")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.