CVE-2026-65890
Received Received - Intake

Unauthenticated SQL Injection in Balbooa Gridbox Extension

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Joomla! Project

Description
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-29
Last Modified
2026-07-29
Generated
2026-07-30
AI Q&A
2026-07-30
EPSS Evaluated
N/A
NVD
CVE-2026-65890

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
balbooa gridbox to 2.20.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated SQL injection vulnerability in the Joomla extension Gridbox versions before 2.20.2. Multiple SQL injection vectors allow attackers to inject malicious SQL queries without authentication.

Detection Guidance

Detecting this vulnerability requires checking if the installed version of Gridbox is below 2.20.2. Review Joomla extensions for Gridbox and verify the version number in the Joomla admin panel or via database queries.

Impact Analysis

An attacker could exploit this to read, modify, or delete database contents, potentially gaining control over the Joomla site. This may lead to data breaches, unauthorized access, or site defacement.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update Gridbox to version 2.20.2 or later. If updating is not possible, consider disabling the Gridbox extension temporarily until the update is applied to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65890. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart