EXPOSURES › CVE-2026-65890
CVE-2026-65890
CRITICALUnauthenticated SQL injection in Balbooa's Gridbox Joomla extension allows attackers to extract or modify database contents without authentication.
An unauthenticated SQL injection flaw in Balbooa's Gridbox extension (v<2.20) lets attackers bypass authentication and manipulate database data. DIB organizations must ensure all third-party Joomla extensions are patched, as unpatched SQLi flaws are high-embarrassment risks that can lead to data breaches and compliance failures.
Shame score — The flaw is unauthenticated, allowing remote attackers to execute arbitrary SQL commands without needing to log in, which is a severe and avoidable negligence.
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.