Atomicorp WAF Research Notes

Research Update - 2026-07-18

Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.

The entries published in this update represent research notes produced during ongoing analysis activities.

These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.

Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.

Presence means a positive research finding was published. Absence means no conclusion should be drawn.

CVE Notes Published in This Update

• CVE-2013-5755 - Yealink VoIP Phone SIP-T38G - Remote Command Execution - rules observed: 390726
• CVE-2014-8877 - WordPress Plugin CM Download Manager 2.0.0 - Code Injection - rules observed: 390726
• CVE-2025-34040 - Zhiyuan OA - arbitrary file upload leading - rules observed: 330791
• CVE-2019-4013 - IBM Bigfix Platform 9.5.9.62 - Arbitrary File Upload - rules observed: 392301
• CVE-2012-1259 - Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities - rules observed: 390727
• CVE-2013-2681 - Cisco Linksys E4200 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2013-4864 - MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2013-7137 - Burden 1.8 - Authentication Bypass - rules observed: 390727
• CVE-2014-8673 - SO Planning 1.32 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2014-9148 - Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2015-3933 - GeniXCMS 0.0.3 - ‘register.php’ SQL Injection - rules observed: 390726
• CVE-2015-4664 - Xceedium Xsuite - Multiple Vulnerabilities - rules observed: 390726
• CVE-2015-4667 - Xceedium Xsuite - Multiple Vulnerabilities - rules observed: 390726
• CVE-2015-6970 - Bosch Security Systems Dinion NBN-498 - Web Interface XML Injection - rules observed: 390726
• CVE-2016-4337 - Ktools Photostore 4.7.5 - Blind SQL Injection - rules observed: 390726
• CVE-2016-6600 - WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities - rules observed: 390727
• CVE-2016-6602 - WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities - rules observed: 390727
• CVE-2016-6603 - WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities - rules observed: 390727
• CVE-2016-9682 - Sonicwall Secure Remote Access 8.1.0.2-14sv - Command Injection - rules observed: 390727
• CVE-2017-16935 - Ametys CMS 4.0.2 - Password Reset - rules observed: 390724
• CVE-2017-17970 - Muviko 1.1 - SQL Injection - rules observed: 390727, 392301
• CVE-2017-17976 - PerfexCRM 1.9.7 - Arbitrary File Upload - rules observed: 392301
• CVE-2017-17999 - RISE 1.9 - ‘search’ SQL Injection - rules observed: 390724
• CVE-2017-18001 - Trustwave SWG 11.8.0.27 - SSH Unauthorized Access - rules observed: 330791
• CVE-2017-5689 - Intel Active Management Technology - System Privileges - rules observed: 390726
• CVE-2018-11535 - Sitemakin SLAC 1.0 - ‘my_item_search’ SQL Injection - rules observed: 340155
• CVE-2018-12596 - Ektron CMS 9.20 SP2 - Improper Access Restrictions - rules observed: 390727
• CVE-2018-15534 - Geutebrueck re_porter 7.8.974.20 - Credential Disclosure - rules observed: 390727
• CVE-2018-18923 - Ticketly 1.0 - ‘kind_id’ SQL Injection - rules observed: 380122
• CVE-2018-7538 - Tuleap 9.17.99.189 - Blind SQL Injection - rules observed: 380122
• CVE-2018-7841 - Schneider Electric U.Motion Builder 1.3.4 - ’track_import_export.php object_id’ Unauthenticated Command Injection - rules observed: 344364
• CVE-2018-9160 - SickRage < v2018.03.09 - Clear-Text Credentials HTTP Response - rules observed: 390727
• CVE-2019-16693 - phpIPAM 1.4 - SQL-Injection - rules observed: 340016
• CVE-2019-1935 - Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities - rules observed: 390724, 390727
• CVE-2019-1937 - Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities - rules observed: 390724, 390727
• CVE-2019-19740 - Octeth Oempro 4.8 - ‘CampaignID’ SQL Injection - rules observed: 392301
• CVE-2020-17463 - Fuel CMS 1.4.7 - ‘col’ SQL Injection (Authenticated) - rules observed: 390727
• CVE-2020-18662 - Gnuboard5 5.3.2.8 - SQL Injection - rules observed: 380122
• CVE-2020-24193 - Daily Tracker System 1.0 - Authentication Bypass - rules observed: 340145
• CVE-2020-25494 - SCO Openserver 5.0.7 - ‘outputform’ Command Injection - rules observed: 344364
• CVE-2020-35545 - Spotweb 1.4.9 - ‘search’ SQL Injection - rules observed: 380122
• CVE-2021-3278 - Local Service Search Engine Management System 1.0 - SQLi Authentication Bypass - rules observed: 340156
• CVE-2021-40617 - openSIS Community Edition 8.0 - SQL Injection - rules observed: 390727
• CVE-2021-42325 - Froxlor 0.10.29.1 - SQL Injection (Authenticated) - rules observed: 390724
• CVE-2021-43140 - Simple Subscription Website 1.0 - SQLi Authentication Bypass - rules observed: 340145
• CVE-2021-44567 - RosarioSIS 7.6 - SQL Injection - rules observed: 392301
• CVE-2022-0332 - Moodle 3.11.4 - SQL Injection - rules observed: 390727
• CVE-2022-27927 - Microfinance Management System 1.0 - ‘customer_number’ SQLi - rules observed: 340016
• CVE-2022-2840 - Wordpress Plugin Zephyr Project Manager 3.2.42 - Multiple SQLi - rules observed: 380122
• CVE-2022-34128 - GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE) - rules observed: 392301
• CVE-2022-38580 - X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF) - rules observed: 390727
• CVE-2022-40032 - Simple Task Managing System v1.0 - SQL Injection (Unauthenticated) - rules observed: 340016
• CVE-2022-40347 - Intern Record System v1.0 - SQL Injection (Unauthenticated) - rules observed: 340016
• CVE-2022-44877 - Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE) - rules observed: 393655
• CVE-2023-0938 - Music Gallery Site v1.0 - SQL Injection on music_list.php - rules observed: 390727
• CVE-2023-33362 - Piwigo 13.6.0 - SQL Injection - rules observed: 390727
• CVE-2024-24495 - Daily Habit Tracker 1.0 - SQL Injection - rules observed: 390727
• CVE-2024-53584 - OpenPanel 0.3.4 - OS Command Injection - rules observed: 344360
• CVE-2025-4524 - WordPress Madara - Local File Inclusion - rules observed: 344360
• CVE-2019-16383 - MOVEit Transfer 11.1.1 - ’token’ Unauthenticated SQL Injection - rules observed: 344366, 380122
• CVE-2017-14611 - Cockpit CMS 0.4.4 < 0.5.5 - Server-Side Request Forgery - rules observed: 390727
• CVE-2018-9302 - Cockpit CMS 0.4.4 < 0.5.5 - Server-Side Request Forgery - rules observed: 390727
• CVE-2021-27828 - In4Suit ERP 3.2.74.1370 - ’txtLoginId’ SQL injection - rules observed: 392301
• CVE-2021-37593 - PEEL Shopping 9.3.0 - ‘id’ Time-based SQL Injection - rules observed: 390727
• CVE-2021-46419 - Telesquare TLR-2855KS6 - Arbitrary File Deletion - rules observed: 393134
• CVE-2024-53537 - OpenPanel 0.3.4 - Directory Traversal - rules observed: 340007
• CVE-2013-5758 - Yealink VoIP Phone SIP-T38G - Privilege Escalation - rules observed: 390726
• CVE-2014-5308 - TestLink 1.9.11 - Multiple SQL Injections - rules observed: 350147, 390726
• CVE-2014-7884 - ArcSight Logger - Arbitrary File Upload / Code Execution - rules observed: 390726
• CVE-2019-7671 - Prima Access Control 2.3.35 - ‘HwName’ Persistent Cross-Site Scripting - rules observed: 390726
• CVE-2013-4863 - MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2014-8356 - ZHONE < S3.0.501 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2014-8357 - ZHONE < S3.0.501 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2014-9118 - ZHONE < S3.0.501 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2015-0104 - IBM Tivoli Service Automation Manager 7.2.4 - Remote Code Execution - rules observed: 392301
• CVE-2015-4117 - Vesta Control Panel 0.9.8 - OS Command Injection - rules observed: 344370
• CVE-2016-4808 - Web2py 2.14.5 - Multiple Vulnerabilities - rules observed: 344360
• CVE-2017-5799 - HPE OpenCall Media Platform (OCMP) 4.3.2 - Cross-Site Scripting / Remote File Inclusion - rules observed: 390726
• CVE-2017-6823 - Fiyo CMS 2.0.6.1 - Privilege Escalation - rules observed: 390724
• CVE-2017-9413 - Subsonic 6.1.1 - Server-Side Request Forgery - rules observed: 390726
• CVE-2018-11442 - EasyService Billing 1.0 - Cross-Site Request Forgery - rules observed: 340147
• CVE-2018-11445 - EasyService Billing 1.0 - Cross-Site Request Forgery - rules observed: 340147
• CVE-2018-15142 - OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions - rules observed: 344360, 344370
• CVE-2018-15884 - RICOH MP C4504ex Printer - Cross-Site Request Forgery (Add Admin) - rules observed: 350147
• CVE-2018-5406 - KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities - rules observed: 390727
• CVE-2018-7765 - Schneider Electric U.Motion Builder 1.3.4 - ’track_import_export.php object_id’ Unauthenticated Command Injection - rules observed: 344364
• CVE-2019-9189 - Prima Access Control 2.3.35 - Arbitrary File Upload - rules observed: 390726
• CVE-2020-25760 - Visitor Management System in PHP 1.0 - SQL Injection (Authenticated) - rules observed: 390727
• CVE-2020-5192 - Hospital Management System 4.0 - ‘searchdata’ SQL Injection - rules observed: 340016, 390727
• CVE-2020-5504 - phpMyAdmin 5.0.0 - SQL Injection - rules observed: 390727
• CVE-2020-6010 - WordPress Plugin LearnPress 3.2.6.7 - ‘current_items’ SQL Injection (Authenticated) - rules observed: 380122
• CVE-2020-7991 - Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password) - rules observed: 340147
• CVE-2022-28079 - College Management System 1.0 - ‘course_code’ SQL Injection (Authenticated) - rules observed: 340145
• CVE-2022-28080 - Royal Event Management System 1.0 - ’todate’ SQL Injection (Authenticated) - rules observed: 340145
• CVE-2023-0903 - Employee Task Management System v1.0 - SQL Injection on edit-task.php - rules observed: 340016
• CVE-2023-0904 - Employee Task Management System v1.0 - SQL Injection on (task-details.php?task_id=?) - rules observed: 340016
• CVE-2023-0912 - Auto Dealer Management System v1.0 - SQL Injection - rules observed: 340016
• CVE-2023-0913 - Auto Dealer Management System v1.0 - SQL Injection in sell_vehicle.php - rules observed: 340016
• CVE-2023-0915 - Auto Dealer Management System v1.0 - SQL Injection on manage_user.php - rules observed: 340016
• CVE-2023-0962 - Music Gallery Site v1.0 - SQL Injection on page Master.php - rules observed: 390727
• CVE-2023-7137 - Client Details System 1.0 - SQL Injection - rules observed: 380122
• CVE-2024-36597 - AEGON LIFE v1.0 Life Insurance Management System - SQL injection vulnerability. - rules observed: 340145
• CVE-2024-9054 - Microchip TimeProvider 4100 (Configuration modules) 2.4.6 - OS Command Injection - rules observed: 392301
• CVE-2025-44177 - White Star Software Protop 4.4.2-2024-11-27 - Local File Inclusion (LFI) - rules observed: 390727
• CVE-2013-2678 - Cisco Linksys E4200 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2013-4862 - MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2016-1337 - Cisco EPC 3928 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2017-12615 - Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1) - rules observed: 392301
• CVE-2017-12617 - Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1) - rules observed: 392301
• CVE-2015-4669 - Xceedium Xsuite - Multiple Vulnerabilities - rules observed: 390726
• CVE-2019-20499 - D-Link DWL-2600AP - Multiple OS Command Injection - rules observed: 390726
• CVE-2019-20500 - D-Link DWL-2600AP - Multiple OS Command Injection - rules observed: 390726
• CVE-2019-20501 - D-Link DWL-2600AP - Multiple OS Command Injection - rules observed: 390726
• CVE-2023-46022 - Blood Bank 1.0 - ‘bid’ SQLi - rules observed: 390727
• CVE-2016-3473 - Oracle BI Publisher 11.1.1.6.0/11.1.1.7.0/11.1.1.9.0/12.2.1.0.0 - XML External Entity Injection - rules observed: 390704, 392301
• CVE-2024-43687 - Microchip TimeProvider 4100 Grandmaster (Banner Config Modules) 2.4.6 - Stored Cross-Site Scripting (XSS) - rules observed: 392301
• CVE-2011-4448 - WikkaWiki 1.3.2 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2011-4899 - WordPress Core 3.3.1 - Multiple Vulnerabilities - rules observed: 340147, 390727
• CVE-2013-0249 - cURL - Buffer Overflow (PoC) - rules observed: 390727
• CVE-2013-2680 - Cisco Linksys E4200 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2013-5639 - Gnew 2013.1 - Multiple Vulnerabilities (2) - rules observed: 390727
• CVE-2013-5640 - Gnew 2013.1 - Multiple Vulnerabilities (2) - rules observed: 390727
• CVE-2013-5694 - Opsview pre 4.4.1 - Blind SQL Injection - rules observed: 390726
• CVE-2013-6041 - Webuzo 2.1.3 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2014-6389 - PHPCompta/NOALYSS 6.7.1 5638 - Remote Command Execution - rules observed: 390726
• CVE-2014-8675 - SO Planning 1.32 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2014-9145 - Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2014-9147 - Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2014-9215 - PBBoard CMS 3.0.1 - SQL Injection - rules observed: 390726
• CVE-2014-9464 - Microweber CMS 0.95 - SQL Injection - rules observed: 390726
• CVE-2015-1400 - NPDS CMS REvolution-13 - SQL Injection - rules observed: 390726
• CVE-2015-1503 - IceWarp Mail Server < 11.1.1 - Directory Traversal - rules observed: 390726, 390727
• CVE-2015-1518 - RedaxScript CMS 2.2.0 - SQL Injection - rules observed: 390726
• CVE-2015-2080 - Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers - rules observed: 390724
• CVE-2015-2824 - WordPress Plugin Simple Ads Manager - Multiple SQL Injections - rules observed: 390724, 390726
• CVE-2015-6401 - Cisco EPC 3928 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2016-1328 - Cisco EPC 3928 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2016-1336 - Cisco EPC 3928 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2016-4309 - Symphony CMS 2.6.7 - Session Fixation - rules observed: 390727
• CVE-2016-4806 - Web2py 2.14.5 - Multiple Vulnerabilities - rules observed: 344360
• CVE-2016-6601 - WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities - rules observed: 390727
• CVE-2017-14523 - Wonder CMS 2.3.1 - ‘Host’ Header Injection - rules observed: 392301
• CVE-2017-5850 - OpenBSD HTTPd < 6.0 - Memory Exhaustion Denial of Service - rules observed: 390727
• CVE-2017-6190 - D-Link DWR-116 / DWR-116A1 - Arbitrary File Download - rules observed: 390727
• CVE-2018-1306 - Apache Portals Pluto 3.0.0 - Remote Code Execution - rules observed: 390727
• CVE-2018-15535 - Responsive FileManager < 9.13.4 - Directory Traversal - rules observed: 390720, 390727
• CVE-2018-7171 - TwonkyMedia Server 7.0.11-8.5 - Directory Traversal - rules observed: 390727
• CVE-2019-19731 - Roxy Fileman 1.4.5 - Directory Traversal - rules observed: 340007
• CVE-2021-37589 - Virtua Software Cobranca 12S - SQLi - rules observed: 340156
• CVE-2021-46381 - DLINK DAP-1620 A1 v1.01 - Directory Traversal - rules observed: 390726
• CVE-2021-46417 - Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion (LFI) - rules observed: 347009
• CVE-2022-34127 - GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin - rules observed: 344360
• CVE-2023-0905 - Employee Task Management System v1.0 - Broken Authentication - rules observed: 350147
• CVE-2023-40279 - OpenClinic GA 5.247.01 - Path Traversal (Authenticated) - rules observed: 390727
• CVE-2023-6063 - WP Fastest Cache 1.2.2 - Unauthenticated SQL Injection - rules observed: 380122
• CVE-2017-15643 - Ikraus Anti Virus 2.16.7 - Remote Code Execution - rules observed: 390727
• CVE-2017-9355 - Subsonic 6.1.1 - XML External Entity Injection - rules observed: 390726
• CVE-2015-4027 - Acunetix WVS 10 - Local Privilege Escalation - rules observed: 390726
• CVE-2018-1002000 - WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting - rules observed: 390726
• CVE-2019-18396 - Technicolor TD5130.2 - Remote Command Execution - rules observed: 344361
• CVE-2019-1936 - Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities - rules observed: 390724, 390727
• CVE-2020-20969 - PluckCMS 4.7.10 - Unrestricted File Upload - rules observed: 390727
• CVE-2023-1211 - phpIPAM 1.5.1 - SQL Injection - rules observed: 380122
• CVE-2024-41357 - phpIPAM 1.6 - Reflected-Cross-Site Scripting (XSS) - rules observed: 340147
• CVE-2024-10758 - NEWS-BUZZ News Management System 1.0 - SQL Injection - rules observed: 380122
• CVE-2025-5298 - Campcodes Online Hospital Management System 1.0 - SQL Injection - rules observed: 390726
• CVE-2011-4449 - WikkaWiki 1.3.2 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2011-4452 - WikkaWiki 1.3.2 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2012-0286 - stoneware webnetwork6 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2012-3350 - Webmatic 3.1.1 - Blind SQL Injection - rules observed: 390727
• CVE-2014-0864 - IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2015-5161 - eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injection - rules observed: 390727, 392301
• CVE-2012-1258 - Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities - rules observed: 390727
• CVE-2012-4240 - Group Office Calendar - ‘/calendar/json.php’ SQL Injection - rules observed: 340016
• CVE-2013-4861 - MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2013-4865 - MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2014-7176 - Enalean Tuleap 7.4.99.5 - Blind SQL Injection - rules observed: 390726
• CVE-2017-3546 - Oracle PeopleSoft - Server-Side Request Forgery - rules observed: 390727
• CVE-2017-6338 - Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities - rules observed: 390724
• CVE-2017-6339 - Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities - rules observed: 390724
• CVE-2018-15140 - OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions - rules observed: 344360, 344370
• CVE-2018-15141 - OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions - rules observed: 344360, 344370
• CVE-2018-5404 - KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities - rules observed: 390727
• CVE-2018-7690 - Fortify Software Security Center (SSC) 17.10/17.20/18.10 - Information Disclosure - rules observed: 390727
• CVE-2018-9038 - Monstra CMS 3.0.4 - Arbitrary Folder Deletion - rules observed: 390727
• CVE-2019-12616 - phpMyAdmin 4.8 - Cross-Site Request Forgery - rules observed: 390727
• CVE-2019-3778 - Spring Security OAuth - Open Redirector - rules observed: 390727
• CVE-2019-7439 - JioFi 4G M2S 1.0.2 - Denial of Service - rules observed: 340147
• CVE-2021-24405 - WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS - rules observed: 390726
• CVE-2021-34369 - Accela Civic Platform 21.1 - ‘contactSeqNumber’ Insecure Direct Object References (IDOR) - rules observed: 390727
• CVE-2022-34125 - GLPI Activity v3.1.0 - Authenticated Local File Inclusion on Activity plugin - rules observed: 344360
• CVE-2025-55911 - ClipBucket 5.5.2 Build - rules observed: 340162
• CVE-2011-4450 - WikkaWiki 1.3.2 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2017-9640 - Automated Logic WebCTRL 6.1 - Path Traversal / Arbitrary File Write - rules observed: 390727
• CVE-2024-7801 - Microchip TimeProvider 4100 Grandmaster (Data plot modules) 2.4.6 - SQL Injection - rules observed: 392301
• CVE-2012-1260 - Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities - rules observed: 390727
• CVE-2012-1261 - Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities - rules observed: 390727
• CVE-2012-5193 - Bitweaver 2.8.1 - Multiple Vulnerabilities - rules observed: 340147, 380026
• CVE-2013-2679 - Cisco Linksys E4200 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2013-2684 - Cisco Linksys E4200 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2015-4668 - Xceedium Xsuite - Multiple Vulnerabilities - rules observed: 390726
• CVE-2017-15687 - Logitech Media Server - Cross-Site Scripting - rules observed: 347198
• CVE-2017-3132 - Fortinet FortiOS < 5.6.0 - Cross-Site Scripting - rules observed: 340147, 390727
• CVE-2017-3133 - Fortinet FortiOS < 5.6.0 - Cross-Site Scripting - rules observed: 340147, 390727
• CVE-2017-5798 - HPE OpenCall Media Platform (OCMP) 4.3.2 - Cross-Site Scripting / Remote File Inclusion - rules observed: 390726
• CVE-2017-6443 - EPSON TMNet WebConfig 1.00 - Cross-Site Scripting - rules observed: 340147
• CVE-2017-9979 - QuantaStor Software Defined Storage < 4.3.1 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2018-12111 - Canon PrintMe EFI - Cross-Site Scripting - rules observed: 347198
• CVE-2018-16833 - ManageEngine Desktop Central 10.0.271 - Cross-Site Scripting - rules observed: 333141
• CVE-2018-17310 - RICOH MP C1803 JPN Printer - Cross-Site Scripting - rules observed: 350147
• CVE-2018-17313 - RICOH MP C1803 JPN Printer - Cross-Site Scripting - rules observed: 350147
• CVE-2018-17587 - Airties AIR5342 1.0.0.18 - Cross-Site Scripting - rules observed: 341266
• CVE-2018-17588 - Airties AIR5342 1.0.0.18 - Cross-Site Scripting - rules observed: 341266
• CVE-2018-17590 - Airties AIR5342 1.0.0.18 - Cross-Site Scripting - rules observed: 341266
• CVE-2018-17591 - Airties AIR5342 1.0.0.18 - Cross-Site Scripting - rules observed: 341266
• CVE-2018-17593 - Airties AIR5342 1.0.0.18 - Cross-Site Scripting - rules observed: 341266
• CVE-2018-19933 - Bolt CMS < 3.6.2 - Cross-Site Scripting - rules observed: 340147
• CVE-2018-20503 - SirsiDynix e-Library 3.5.x - Cross-Site Scripting - rules observed: 340147
• CVE-2018-7203 - TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting - rules observed: 340147
• CVE-2019-11398 - UliCMS 2019.1 ‘Spitting Lama’ - Persistent Cross-Site Scripting - rules observed: 342259
• CVE-2019-11844 - RICOH SP 4520DN Printer - HTML Injection - rules observed: 350147
• CVE-2019-11845 - RICOH SP 4510DN Printer - HTML Injection - rules observed: 350147
• CVE-2019-14427 - Ultimate Loan Manager 2.0 - Cross-Site Scripting - rules observed: 390585
• CVE-2019-18859 - Digi AnywhereUSB 14 - Reflective Cross-Site Scripting - rules observed: 390727
• CVE-2019-1943 - CISCO Small Business 200 / 300 / 500 Switches - Multiple Vulnerabilities - rules observed: 390727
• CVE-2019-7438 - JioFi 4G M2S 1.0.2 - ‘mask’ Cross-Site Scripting - rules observed: 340149
• CVE-2019-9553 - Bolt CMS 3.6.4 - Cross-Site Scripting - rules observed: 340148
• CVE-2019-9591 - ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities - rules observed: 390727
• CVE-2019-9592 - ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities - rules observed: 390727
• CVE-2019-9593 - ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities - rules observed: 390727
• CVE-2020-15599 - Victor CMS 1.0 - ‘user_firstname’ Persistent Cross-Site Scripting - rules observed: 340147
• CVE-2020-24609 - Savsoft Quiz 5 - Stored Cross-Site Scripting - rules observed: 340147
• CVE-2020-25495 - SCO Openserver 5.0.7 - ‘section’ Reflected XSS - rules observed: 341266
• CVE-2020-5191 - Hospital Management System 4.0 - Persistent Cross-Site Scripting - rules observed: 342259
• CVE-2021-24245 - WordPress Plugin Stop Spammers 2021.8 - ’log’ Reflected Cross-site Scripting (XSS) - rules observed: 333141
• CVE-2021-24563 - WordPress Plugin Frontend Uploader 1.3.2 - Stored Cross Site Scripting (XSS) (Unauthenticated) - rules observed: 392301
• CVE-2021-33904 - Accela Civic Platform 21.1 - ‘servProvCode’ Cross-Site-Scripting (XSS) - rules observed: 390727
• CVE-2021-34370 - Accela Civic Platform 21.1 - ‘successURL’ Cross-Site-Scripting (XSS) - rules observed: 390727
• CVE-2021-41878 - i-Panel Administration System 2.0 - Reflected Cross-site Scripting (XSS) - rules observed: 347198
• CVE-2021-45425 - SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS) - rules observed: 341266
• CVE-2021-46387 - Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS) - rules observed: 333141
• CVE-2022-35155 - Bus Pass Management System 1.0 - Cross-Site Scripting (XSS) - rules observed: 340147
• CVE-2023-38910 - CSZ CMS 1.3.0 - Stored Cross-Site Scripting (‘Photo URL’ and ‘YouTube URL’ ) - rules observed: 333141
• CVE-2023-46020 - Blood Bank v1.0 - Stored Cross Site Scripting (XSS) - rules observed: 333141
• CVE-2024-24494 - Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS) - rules observed: 340147
• CVE-2014-0867 - IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2018-15536 - Responsive FileManager < 9.13.4 - Directory Traversal - rules observed: 390720, 390727
• CVE-2014-8674 - SO Planning 1.32 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2017-3131 - Fortinet FortiOS < 5.6.0 - Cross-Site Scripting - rules observed: 340147, 390727
• CVE-2017-6340 - Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities - rules observed: 390724
• CVE-2018-16736 - Roundcube rcfilters plugin 2.1.6 - Cross-Site Scripting - rules observed: 340147
• CVE-2018-5405 - KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities - rules observed: 390727
• CVE-2019-11269 - Spring Security OAuth - Open Redirector - rules observed: 390727
• CVE-2019-9556 - Fiberhome AN5506-04-F RP2669 - Persistent Cross-Site Scripting - rules observed: 340147
• CVE-2020-11456 - LimeSurvey 4.1.11 - ‘Survey Groups’ Persistent Cross-Site Scripting - rules observed: 333141
• CVE-2020-11457 - pfSense 2.4.4-P3 - ‘User Manager’ Persistent Cross-Site Scripting - rules observed: 333141
• CVE-2020-12706 - php-fusion 9.03.50 - Persistent Cross-Site Scripting - rules observed: 340147
• CVE-2020-24963 - Best Support System 3.0.4 - ’ticket_body’ Persistent XSS (Authenticated) - rules observed: 333141
• CVE-2020-27533 - DedeCMS v.5.8 - keyword Cross-Site Scripting - rules observed: 340147
• CVE-2020-7108 - WordPress Plugin LearnDash LMS 3.1.2 - Reflective Cross-Site Scripting - rules observed: 390727
• CVE-2023-0902 - Employee Task Management System v1.0 - SQL Injection on edit-task.php - rules observed: 340016
• CVE-2023-38911 - CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin ‘Gallery’) - rules observed: 333141
• CVE-2023-4382 - Hyip Rio 2.1 - Arbitrary File Upload - rules observed: 392301
• CVE-2024-48120 - X2CRM 8.5 - Stored Cross-Site Scripting (XSS) - rules observed: 390726
• CVE-2013-2683 - Cisco Linksys E4200 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2014-8676 - SO Planning 1.32 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2014-8677 - SO Planning 1.32 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2015-2826 - WordPress Plugin Simple Ads Manager - Information Disclosure - rules observed: 344370
• CVE-2017-9978 - QuantaStor Software Defined Storage < 4.3.1 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2021-26085 - Atlassian Confluence 7.12.2 - Pre-Authorization Arbitrary File Read - rules observed: 390727
• CVE-2021-26086 - Atlassian Jira Server Data Center 8.16.0 - Arbitrary File Read - rules observed: 345113, 390727
• CVE-2021-34429 - Eclipse Jetty 11.0.5 - Sensitive File Disclosure - rules observed: 390703
• CVE-2022-31062 - GLPI Glpiinventory v1.0.1 - Unauthenticated Local File Inclusion - rules observed: 344360
• CVE-2024-53586 - WebFileSys 2.31.0 - Directory Path Traversal - rules observed: 390726
• CVE-2025-10493 - Chained Quiz 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie - rules observed: 390726
• CVE-2006-3835 - toutvirtual virtualiq pro 3.2 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2011-4898 - WordPress Core 3.3.1 - Multiple Vulnerabilities - rules observed: 340147, 390727
• CVE-2012-5192 - Bitweaver 2.8.1 - Multiple Vulnerabilities - rules observed: 340147, 380026
• CVE-2012-5451 - TVMOBiLi 2.1.0.3557 - Denial of Service - rules observed: 390727
• CVE-2012-5875 - FireFly Mediaserver 1.0.0.1359 - Null Pointer Dereference - rules observed: 390727
• CVE-2012-5876 - Nero MediaHome 4.5.8.0 - Denial of Service - rules observed: 390726, 390727
• CVE-2012-5877 - Nero MediaHome 4.5.8.0 - Denial of Service - rules observed: 390726, 390727
• CVE-2013-6043 - Webuzo 2.1.3 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2015-4666 - Xceedium Xsuite - Multiple Vulnerabilities - rules observed: 390726
• CVE-2015-5285 - Kallithea 0.2.9 - ‘came_from’ HTTP Response Splitting - rules observed: 390727
• CVE-2014-0865 - IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2014-0868 - IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2015-4425 - Pimcore CMS Build 3450 - Directory Traversal - rules observed: 390726
• CVE-2021-24966 - WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated) - rules observed: 344360
• CVE-2016-4807 - Web2py 2.14.5 - Multiple Vulnerabilities - rules observed: 344360
• CVE-2018-1002001 - WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting - rules observed: 390726
• CVE-2018-1002002 - WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting - rules observed: 390726
• CVE-2018-1002003 - WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting - rules observed: 390726
• CVE-2018-1002004 - WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting - rules observed: 390726
• CVE-2018-1002005 - WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting - rules observed: 390726
• CVE-2018-1002006 - WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting - rules observed: 390726
• CVE-2018-1002007 - WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting - rules observed: 390726
• CVE-2018-1002008 - WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting - rules observed: 390726
• CVE-2018-1002009 - WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting - rules observed: 390726
• CVE-2020-29240 - LEPTON CMS 4.7.0 - ‘URL’ Persistent Cross-Site Scripting - rules observed: 333141
• CVE-2020-29470 - OpenCart 3.0.3.6 - ‘subject’ Stored Cross-Site Scripting - rules observed: 342259
• CVE-2020-29477 - Invision Community 4.5.4 - ‘Field Name’ Stored Cross-Site Scripting - rules observed: 340147
• CVE-2020-35241 - Flatpress Add Blog 1.0.3 - Persistent Cross-Site Scripting - rules observed: 390724
• CVE-2024-24050 - Workout Journal App 1.0 - Stored XSS - rules observed: 380026, 390727
• CVE-2007-3385 - Apache Tomcat 6.0.15 - Cookie Quote Handling Remote Information Disclosure - rules observed: 390727
• CVE-2008-2938 - toutvirtual virtualiq pro 3.2 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2011-4451 - WikkaWiki 1.3.2 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2012-0285 - stoneware webnetwork6 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2012-0782 - WordPress Core 3.3.1 - Multiple Vulnerabilities - rules observed: 340147, 390727
• CVE-2013-2682 - Cisco Linksys E4200 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2013-6042 - Webuzo 2.1.3 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2014-0191 - eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injection - rules observed: 390727
• CVE-2014-0866 - IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2014-0869 - IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2014-0870 - IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2014-0871 - IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2014-1944 - Ilch CMS 2.0 - Persistent Cross-Site Scripting - rules observed: 344370
• CVE-2014-9146 - Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2015-1389 - Aruba ClearPass Policy Manager - Persistent Cross-Site Scripting - rules observed: 333141
• CVE-2015-2275 - WoltLab Community Gallery - Persistent Cross-Site Scripting - rules observed: 390726
• CVE-2015-4665 - Xceedium Xsuite - Multiple Vulnerabilities - rules observed: 390726
• CVE-2015-6402 - Cisco EPC 3928 - Multiple Vulnerabilities - rules observed: 390726
• CVE-2022-0377 - WordPress Plugin Learnpress 4.1.4.1 - Arbitrary Image Renaming - rules observed: 340007
• CVE-2025-41228 - VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS) - rules observed: 390727
• CVE-2014-1222 - Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities - rules observed: 344360, 390726
• CVE-2014-0894 - IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities - rules observed: 392301
• CVE-2013-5759 - Yealink VoIP Phone SIP-T38G - Privilege Escalation - rules observed: 390726
• CVE-2022-43128 - Dreamer CMS v4.0.0 - SQL Injection - rules observed: 380122
• CVE-2023-46391 - WEBIGniter v28.7.23 - Stored Cross Site Scripting (XSS) - rules observed: 340147
• CVE-2024-24497 - Employee Management System 1.0 - txtusername and txtpassword SQL Injection (Admin Login) - rules observed: 340156
• CVE-2026-11111 - Research note for exploit techniques associated with CVE-2026-11111 - rules observed: 340016, 340162
• CVE-2026-48907 - Research note for exploit techniques associated with CVE-2026-48907 - rules observed: 383871, 333360