[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"vulnerability-29775":44,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":78,"FormattedDate_snqKtPP8l9Yw7EZMQLXi4H1hnJFxwsGACMeAVsGo0lY":85,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":92,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":98},[4,15,21,27,33,39],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Network Scanner","compliance-pages-launch-network-scanner","Scheduled scans are the spine of every compliance framework. Are you audit-ready?","https:\u002F\u002Fpentest-tools.com\u002Fusage\u002Fcompliance",false,[11],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Get compliance evidence","secondary","compliance-pages-launch",{"title":16,"slug":17,"text":18,"link":8,"external":9,"targets":19,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Website Scanner","compliance-pages-launch-website-scanner","Authenticated web-app scans show up in SOC 2, NIS2, and CRA Annex I. See why this is crucial for the business.",[20],"\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner",{"title":22,"slug":23,"text":24,"link":8,"external":9,"targets":25,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Advanced Pentest Reporting","compliance-pages-launch-reporting","Editable DOCX. Immutable PDF. JSON for the GRC tool. See why these formats are on every auditor's checklist.",[26],"\u002Ffeatures\u002Fpentest-reporting",{"title":28,"slug":29,"text":30,"link":8,"external":9,"targets":31,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Integrations","compliance-pages-launch-integrations","Vanta, Jira, webhooks - they all route back to DORA, NIS2, SOC 2, ISO 27001, CRA. See why this is crucial for the business.",[32],"\u002Ffeatures\u002Fintegrations",{"title":34,"slug":35,"text":36,"link":8,"external":9,"targets":37,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Sniper","compliance-pages-launch-sniper","Five compliance framework pages now reference Sniper as the source of validated exploitability evidence. See them all.",[38],"\u002Fexploit-helpers\u002Fsniper",{"title":40,"slug":14,"text":41,"link":8,"external":9,"targets":42,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Homepage","Turn confirmed vulnerabilities into evidence your auditor accepts. Testing requirements for DORA, NIS2, SOC 2, ISO 27001, and CRA.",[43],"\u002F",{"id":45,"detectable_with":46,"vuln_details":52,"vuln_id":75,"name":76,"published":77,"updated":77},29775,{"tool":47,"engine":50},{"id":48,"name":49},1,"Network Scanner",{"id":48,"name":51},"Sniper",{"id":45,"codename":53,"description":54,"severity":55,"risk_description":56,"public_description":57,"public_recommendation":58,"recommendation":59,"references":60,"cvssv3":63,"epss_score":64,"epss_percentile":65,"cve":66,"in_cisa_catalog":68,"date":69,"software_type":70,"vendor":71,"product":72,"ptt_exploit_capabilities":73},null,"We found that the target Joomla site is running the Balbooa Forms extension, versions 1.0 through 2.4.0, which is vulnerable to an unauthenticated remote code execution. The vulnerability stems from a missing authentication check in the form attachment upload feature (com_baforms, task=form.uploadAttachmentFile): an unauthenticated attacker can submit a crafted multipart\u002Fform-data request to the upload endpoint and store an arbitrary file, including executable PHP, under the web-accessible images\u002Fbaforms\u002Fuploads\u002F directory without any file-type or content validation. Because the uploaded file is stored in a location directly served by the web server, the attacker can execute arbitrary code by requesting the uploaded file directly.","critical","The risk exists that a remote unauthenticated attacker can fully compromise the server to steal confidential information, install ransomware, or pivot to the internal network.","The Balbooa Forms extension for Joomla, versions 1.0 through 2.4.0, is vulnerable to unauthenticated remote code execution due to an unrestricted file upload in its form attachment feature. An attacker can submit a crafted multipart\u002Fform-data request to the attachment upload endpoint (com_baforms, task=form.uploadAttachmentFile) and store a PHP file under a web-accessible uploads directory. Because the endpoint requires no authentication and performs insufficient validation, the uploaded PHP file can be requested and executed remotely.","Update the Balbooa Forms extension to version 2.4.1 or later.","We recommend updating the Balbooa Forms extension to version 2.4.1 or later; if immediate update is not possible, disable or restrict the form attachment upload feature and ensure uploaded files are stored outside a web-executable location.",[61,62],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-56291","https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog",9.8,0.14854,0.96635,[67],"CVE-2026-56291",true,"2026-07-09T00:00:00Z","Joomla Extension","Balbooa","Forms",[74],"RCE","NETSCAN-SNIPER-CVE-2026-56291","Joomla Balbooa Forms - Remote Code Execution","2026-09-22T00:00:00Z",["Island",79],{"key":80,"params":81,"result":83},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":82},"{}",{"head":84},{},["Island",86],{"key":87,"params":88,"result":90},"FormattedDate_snqKtPP8l9Yw7EZMQLXi4H1hnJFxwsGACMeAVsGo0lY",{"props":89},"{\"date\":\"2026-09-22T00:00:00Z\",\"format\":\"MMMM dd, yyyy\"}",{"head":91},{},["Island",93],{"key":94,"params":95,"result":96},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":82},{"head":97},{},["Island",99],{"key":100,"params":101,"result":103},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":102},"{\"text-color\":\"gray\"}",{"head":104},{}]