Critical· 9.2official fix available
CVE-2026-65890
A Joomla extension called Gridbox from balbooa.com has a serious SQL injection flaw that lets anyone run arbitrary database commands without logging in. The flaw exists in all versions before 2.20.2.
publishedJul 29, 2026
last modifiedJul 29, 2026
sourcesNVD
severity · cvss
9.2
critical · how bad it is
exploitation · epss
n/a
chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 28, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
Joomla users running the Gridbox extension version earlier than 2.20.2.
02
Real-world impact
An attacker could read, modify, or delete data in the Joomla database, potentially taking over the site or stealing sensitive information.
03
Why this severity
The CVSS score of 9.2 reflects that the flaw is easy to exploit (no authentication required), can be used to execute any SQL command, and can lead to complete compromise of the site.
04
What to do about it
official fix available
recommended steps
- 01Upgrade to Gridbox version 2.20.2 or later.
NVD description
05
Timeline
- Jul 29, 2026 · 22h agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 21h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Attack requirementsPresent
Privileges requiredNone
User interactionNone needed
Confidentiality impactHigh
Integrity impactLow
Availability impactLow
07
References & advisories
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →