CVE-2026-102788

The Joomla Extension - balbooa.com (Gridbox) versions prior to 2.20.4.2 are vulnerable to an unauthenticated SQL injection . On store product list pages, the sort-by URL parameter is retrieved and passed to GridboxHelper::getBlogPosts(). If the parameter does not match known keys, it is prefixed ...

CVE-2026-102788 Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts. When the parameter does not match known sorting keys, it ...

EUVD-2026-110645

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts. When the parameter does not match known sorting keys, it ...

PT-2026-126305

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts. When the parameter does not match known sorting keys, it ...