CVE-2026-65890 CRITICAL

CVE-2026-65890: Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2

Vendor Balbooa.com

Product Gridbox extension for Joomla

Weakness CWE-89 · SQLi

Published July 29, 2026

Last update July 29, 2026

View on NVD All CVEs

CVSS base score

9.2/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H

What the vulnerability does

01Description

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.

Explanation of Vulnerability in Simple Terms

02Summary

The Gridbox extension for Joomla contains a SQL injection vulnerability in versions up to 2.20.1. An attacker on the network can craft malicious input to execute arbitrary SQL queries against the site's database without authentication. This allows reading, modifying, or deleting sensitive data including user credentials and site configuration.

What an attacker can do

03Attacker Capabilities

Execute arbitrary SQL queries to read, modify, or delete database contents without logging in.

Potential impact on your site

04Site Impact

Attackers can steal user passwords, modify site content, or disable the site by corrupting the database.

Conditions required to exploit

05Prerequisites

Network access to the Joomla site; no authentication or user interaction required.

Key dates

06Disclosure timeline

July 29, 2026 CVE published

July 29, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-65890 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html AskarLabs — CWE-89 write-up SQL Injection

Related vulnerabilities

Identifiers

CVE CVE-2026-65890

CWE CWE-89

CVSS 9.2 / CRITICAL

Affected versions