Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
Warning: Critical vulnerabilities in #Joomla #Balbooa #Gridbox! #CVE-2026-102788 (SQL Injection) & #CVE-2026-102789 expose systems to unauthorized access and generate security risks. Upgrade to Gridbox 2.20.4.2! https://www.balbooa.com/blog/gridbox/gridbox-2-20-4-2-security-hardening-update#:~:text=CVE%2D2026%2D102788%2C%20CVE%2D2026%2D102789,Gridbox%202.20.4.2&text=October%2022%2C%202026,Read%20More #Patch #Patch #Patch
🚨 Joomla sites running the Gridbox page builder: an unauthenticated SQL injection rated CVSS 9.3, plus a missing authorization check 🆔 CVE-2026-102788 · CVSS 4.0: 9.3 (Joomla, CNA): on store product list pages, the sort-by URL parameter is inserted into the ORDER BY clause without an allowlist check 🆔 CVE-2026-102789 · CVSS 4.0: 9.3 (Joomla, CNA): EditorController::getBlogPosts() skips the checkUserEditLevel() authorization check that other editor tasks use 📦 Affected: Gridbox 1.0.0 through 2.20.4.1 ✅ Fixed: 2.20.4.2 ⚠️ No exploitation reported; not in CISA KEV 🛡️ Update Gridbox to 2.20.4.2 now 🔗 https://www.cve.org/CVERecord?id=CVE-2026-102788 #Joomla #SQLi #CVE