Atomicorp WAF Research Notes
Research Update - 2026-10-01
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2026-76570 | Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1 | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-61913 | Flowise is vulnerable to arbitrary file read, arbitrary file write | 340007 , 344360 , 390709 |
| CVE-2025-40690 | SQL injection in PHPGurukul Online Fire Reporting System | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-41018 | SQL injection vulnerability in Sergestec's Exito | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-41029 | SQL injection in Zeon Academy Pro by Zeon Global Tech | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-71284 | Synway SMG Gateway Management Software OS Command Injection via radius_address | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-71336 | Flowise - Unsandboxed Remote Code Execution via Custom MCP | 334168 , 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390719 , 393655 |
| CVE-2026-62308 | Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-62606 | my little forum vulnerable to SQL Injection in Bookmark Reordering via bookmarks parameter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2023-54402 | iDocView SSRF via /doc/upload Endpoint Hardcoded Token | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2023-54403 | Yonyou U8 CRM Arbitrary File Read via getemaildata.php | 340007 , 344360 , 347009 , 390709 |
| CVE-2024-58387 | Inspur HCM Cloud Arbitrary File Read via file/download Endpoint | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-103474 | yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE | 351000 |
| CVE-2026-55094 | Taskcluster: Unauthenticated remote code execution in web-server via GraphQL filter argument (sift $where) | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-61875 | luci-app-upnp Stored XSS via UPnP Port Mapping Description | 333140 , 333141 |
| CVE-2025-68455 | Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-46711 | Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-59095 | LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-69222 | LibreChat is vulnerable to Server-Side Request Forgery due to missing restrictions | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-14804 | Frontend File Manager < 23.5 - Subscriber+ Arbitrary File Deletion | 340748 , 344360 , 347006 , 390709 |
| CVE-2026-55177 | CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guar | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-59527 | FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-14151 | SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62519 | phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-96561 | AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advi | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62597 | WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'sql' | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62598 | WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'action' | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-103530 | decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-13891 | Image Gallery – Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory Listing | 340748 , 344360 , 347006 , 390709 |
| CVE-2025-14545 | YML for Yandex Market < 5.0.26 - Shop Manager+ RCE via Feed Generation | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 382238 , 390501 , 393655 |
| CVE-2025-9318 | Quiz and Survey Master (QSM) <= 10.3.1 - Authenticated (Subscriber+) SQL Injection via is_linking Query Parameter | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2025-61669 | jupyter_server next parameter open redirect can redirect users to external domains | 344365 |
| CVE-2026-102983 | Astro: Netlify Image CDN allowlist bypass enables SSRF | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-65954 | SimpleSAMLphp-casserver has an Open Redirect vulnerability via logout | 344365 |
| CVE-2025-8280 | Contact Form 7 reCAPTCHA <= 1.2.0 - Reflected XSS via $_SERVER['REQUEST_URI'] | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2025-10091 | Jinher OA XML Type xml external entity reference | 330791 , 340152 , 341256 , 344360 , 344370 , 344372 , 344373 , 347009 , 380018 |
| CVE-2025-10479 | SourceCodester Online Student File Management System index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10564 | Campcodes Grocery Sales and Inventory System ajax.php sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2025-10709 | Four-Faith Water Conservancy Informatization Platform historyDownload.do;otheruserLogin.do;getfile path traversal | 344360 , 347009 , 390709 |
| CVE-2025-10796 | code-projects Hostel Management System login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10798 | code-projects Hostel Management System index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11037 | code-projects E-Commerce Website admin_index_search.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11061 | Campcodes Online Learning Management System edit_student.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11109 | Campcodes Computer Sales and Inventory System us_edit.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11396 | code-projects Simple Food Ordering System product.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11475 | projectworlds Advanced Library Management System view_member.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11583 | code-projects Online Job Search Engine postjob.php sql injection | 340017 , 341245 , 380122 |
| CVE-2025-12253 | AMTT Hotel Broadband Operation System get_expiredtime.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13247 | PHPGurukul Tourism Management System user-bookings.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14258 | itsourcecode Student Management System newsubject.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15420 | Yonyou KSOA agent_work_report.jsp sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15432 | yeqifu carRental com.yeqifu.sys.controller.FileController downloadShowFile.action downloadShowFile path traversal | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-15434 | Yonyou KSOA PrintZPYG.jsp sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15435 | Yonyou KSOA work_update.jsp sql injection | 340017 , 340145 , 340156 , 341145 , 341245 , 380026 , 380122 , 390572 |
| CVE-2025-15436 | Yonyou KSOA work_edit.jsp sql injection | 340017 , 340145 , 340156 , 341145 , 341245 , 380026 , 380122 , 390572 |
| CVE-2026-103229 | AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103230 | AdithyaYelloju Restaurant-Management-System Order Placement ord.php mysqli_query sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103231 | AdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mysqli_query sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103232 | AdithyaYelloju Restaurant-Management-System table_booking.php mysqli_query sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2024-31027 | Greek Universities Network (GUnet) Open eClass Platform v.3.15 Arbitrary Code Execution Vulnerability | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62178 | WeGIA Cross-Site Scripting (XSS) Reflected endpoint '/html/atendido/cadastro_atendido_parentesco_pessoa_nova.php' parame | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-10097 | SimStudioAI sim route.ts code injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-10268 | Printcart Web to Print Product Designer for WooCommerce <= 2.4.8 - Unauthenticated Folder Content Disclosure via Path Tr | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-47096 | AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2023-53899 | PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection | 337109 , 337110 , 398021 , 398022 |
| CVE-2025-40640 | Stored Cross-Site Scripting (XSS) in Energy CRM by Status Tracker | 333140 , 340095 , 340147 , 341256 , 342259 , 346755 |
| CVE-2025-40642 | Reflected Cross-Site Scripting (XSS) in WebWork | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-40693 | Cross Site Scripting in PHPGurukul Online Fire Reporting System | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-40990 | Stored XSS in Creativeitem Ekushey CRM | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-41036 | Stored Cross-Site Scripting vulnerability in appRain CMF | 333140 , 333141 , 340147 , 340148 , 346755 |
| CVE-2025-41044 | Stored Cross-Site Scripting vulnerability in appRain CMF | 333140 , 333141 , 342259 |
| CVE-2025-71385 | Netdata < 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg Endpoint | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-103587 | QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-103589 | QloApps through 1.7.0 Reflected XSS via Room Type Editor | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-103590 | QloApps through 1.7.0 Reflected XSS via Length of Stay Fields | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12569 | WP Front User Submit < 5.0.0 - Open Redirect | 344365 |
| CVE-2025-66447 | Chamilo LMS has validation-less redirect on login page | 344365 |
| CVE-2025-10063 | itsourcecode POS Point of Sale System deferred_table.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2025-10067 | itsourcecode POS Point of Sale System empty_table.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2025-10387 | codesiddhant Jasmin Ransomware handshake.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10420 | SourceCodester Student Grading System form137.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10839 | SourceCodester Pet Grooming Management Software inv-print.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11041 | itsourcecode Open Source Job Portal index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11138 | mirweiye wenkucms common.php createPathOne os command injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-11597 | code-projects E-Commerce Website product_add_qty.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 , 390572 |
| CVE-2025-11629 | RainyGao DocSys getUserList.do getUserList sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12256 | code-projects Online Event Judging System edit_contestant.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12261 | CodeAstro Gym Management System remove-announcement.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12328 | shawon100 RUET OJ contestproblem.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12926 | SourceCodester Farm Management System review.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13174 | rachelos WeRSS we-mp-rss Webhook mps.py do_job server-side request forgery | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-13289 | 1000projects Design & Development of Student Database Management System SubjectDetails.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13290 | code-projects Simple Food Ordering System saveorder.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14962 | code-projects Simple Stock System chatuser.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15094 | sunkaifei FlyCMS User Login UserController.java userLogin cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15212 | code-projects Refugee Food Management System regfood.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15450 | sfturing hosp_order orderHos findOrderHosNum sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9755 | Khanakag-17 Library Management System index.php cross site scripting | 333140 , 333141 , 340087 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-103114 | OS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103115 | OS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103116 | OS4ED openSIS-Classic Student List Search Endpoint GetStuListFnc.php DBQuery sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103540 | formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-103541 | formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload | 351000 |
| CVE-2026-103543 | itsourcecode Leave Management System controller.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12873 | Campcodes School File Management update_user.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15138 | prasathmani TinyFileManager tinyfilemanager.php path traversal | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-15219 | SohuTV CacheCloud MachineManageController.java doPodList cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-103113 | OS4ED openSIS-Classic General Information Tab Student.php save action sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103117 | OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10940 | Total.js CMS Layout admin layouts_save cross site scripting | 333140 , 340087 , 340099 , 340147 , 341099 , 341266 |
| CVE-2025-11069 | westboy CicadasCMS Add Department save cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-12303 | PHPGurukul Curfew e-Pass Management System admin-profile.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15202 | SohuTV CacheCloud TaskController.java taskQueueList cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15214 | Campcodes Park Ticketing System admin_class.php save_pricing cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-15451 | xnx3 wangmarket System Variables variableSave.do cross site scripting | 320013 , 333140 , 333141 , 340099 , 340147 , 341099 , 341266 |
| CVE-2025-15452 | xnx3 wangmarket Backend Variable Search variableList.do variableList cross site scripting | 320013 , 333140 , 333141 , 340099 , 340147 , 341099 , 341266 |
| CVE-2025-15454 | zhanglun lettura RSS ContentRender.tsx cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |