Atomicorp WAF Research Notes

Research Update - 2026-10-02

Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.

The entries published in this update represent research notes produced during ongoing analysis activities.

These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.

Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.

Presence means a positive research finding was published. Absence means no conclusion should be drawn.

CVE Notes Published in This Update

CVEVulnerability NameRules Observed
CVE-2009-3843Apache Tomcat Manager Authenticated Upload Code Execution330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801
CVE-2009-4188Apache Tomcat Manager Authenticated Upload Code Execution330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801
CVE-2009-4189Apache Tomcat Manager Authenticated Upload Code Execution330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801
CVE-2010-5324Novell ZENworks Configuration Management Remote Execution340128 , 344370 , 360152 , 380018 , 390801
CVE-2011-10019Spreecommerce 0.60.1 Arbitrary Command Execution340128 , 380018 , 390801
CVE-2012-3260HP SiteScope Remote Code Execution330791 , 334168 , 340007 , 340128 , 340152 , 344370 , 347019 , 360152 , 380018 , 390801
CVE-2012-3261HP SiteScope Remote Code Execution330791 , 334168 , 340007 , 340128 , 340152 , 344370 , 347019 , 360152 , 380018 , 390801
CVE-2012-5201HP Intelligent Management Center Arbitrary File Upload330791 , 334168 , 340152 , 360152
CVE-2012-5692Invision IP.Board unserialize() PHP Code Execution360152
CVE-2013-4822HP Intelligent Management Center BIMS UploadServlet Directory Traversal344360 , 347009 , 390709
CVE-2013-4837HP LoadRunner EmulationAdmin Web Service Directory Traversal344360
CVE-2013-6221HP AutoPass License Server File Upload340006 , 390719
CVE-2014-125123Kloxo SQL Injection and Remote Code Execution334168 , 340145 , 340156 , 341145 , 341245
CVE-2014-3828Centreon SQL and Command Injection340016 , 340017 , 340144 , 340145 , 340156 , 341145 , 341245 , 344370 , 360147 , 360148
CVE-2014-3829Centreon SQL and Command Injection340016 , 340017 , 340144 , 340145 , 340156 , 341145 , 341245 , 344370 , 360147 , 360148
CVE-2014-3914Rocket Servergraph Admin Center fileRequestor Remote Code Execution340007 , 344360 , 390709
CVE-2021-22205GitLab Unauthenticated Remote ExifTool Command Injection330791 , 334168 , 340152
CVE-2025-52691SmarterTools SmarterMail GUID File Upload Vulnerability340006 , 340007 , 344360 , 390709 , 390719
CVE-2019-1003029Jenkins ACL Bypass and Metaprogramming RCE344361 , 344363
CVE-2024-2044pgAdmin Session Deserialization RCE340006 , 340007 , 344360 , 390709 , 390719
CVE-2011-3923Apache Struts ParametersInterceptor Remote Code Execution360152 , 380018 , 390801
CVE-2013-0803PolarBear CMS PHP File Upload Vulnerability330791 , 334168 , 340152
CVE-2013-1359SonicWALL GMS 6 Arbitrary File Upload330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390700 , 390801
CVE-2013-7390ManageEngine Desktop Central AgentLogUpload Arbitrary File Upload340128 , 360152 , 380018 , 390801
CVE-2015-10143WordPress Platform Theme File Upload Vulnerability330791 , 334168 , 340152
CVE-2015-2857Accellion FTA getStatus verify_oauth_token Command Execution340128 , 360152 , 380018 , 390801
CVE-2015-9266Ubiquiti airOS Arbitrary File Upload330791 , 334168 , 340152
CVE-2017-1000002ATutor 2.2.1 Directory Traversal / Remote Code Execution320464 , 320465 , 340006 , 340007 , 344360 , 347009 , 390709 , 390719
CVE-2017-17560Western Digital MyCloud multi_uploadify File Upload Vulnerability330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390700 , 390801
CVE-2017-9101PlaySMS import.php Authenticated CSV File Upload Code Execution330791 , 334168 , 340152
CVE-2018-14933NUUO NVRmini upgrade_handle.php Remote Command Execution340128 , 360152 , 380018 , 390801
CVE-2018-15708Nagios XI Magpie_debug.php Root Remote Code Execution340128 , 344370 , 360152 , 380018 , 390720 , 390801 , 390904
CVE-2018-15961Adobe ColdFusion CKEditor unrestricted file upload330791 , 334168 , 340152
CVE-2018-17179OpenEMR 5.0.1 Patch 6 SQLi Dump340145 , 340156 , 340157 , 340159 , 341145 , 341245 , 360147 , 360148
CVE-2019-10692WordPress Google Maps Plugin SQL Injection340145 , 340156 , 341145 , 341245 , 390572
CVE-2019-13373D-Link Central WiFiManager SQL injection340145
CVE-2019-1620Cisco Data Center Network Manager Unauthenticated Remote Code Execution330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801
CVE-2019-1821Cisco Prime Infrastructure Health Monitor TarArchive Directory Traversal Vulnerability340006 , 390719
CVE-2019-9960LimeSurvey Zip Path Traversals340007 , 344360 , 347009 , 390709
CVE-2020-13166Plesk/myLittleAdmin ViewState .NET Deserialization340145 , 340156 , 341145 , 341245
CVE-2020-35665TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution340087 , 340095 , 340128 , 344363 , 346755 , 350147 , 360152 , 380018 , 390801 , 390811
CVE-2020-7356Cayin xPost wayfinder_seqid SQLi to RCE340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 344370 , 360147 , 360148
CVE-2020-8644PlaySMS index.php Unauthenticated Template Injection Code Execution340130 , 393655
CVE-2021-21985VMware vCenter Server Virtual SAN Health Check Plugin RCE340162 , 340163
CVE-2021-35587Oracle Access Manager unauthenticated Remote Code Execution344361 , 344363
CVE-2021-40539ManageEngine ADSelfService Plus CVE-2021-40539340006 , 340007 , 340029 , 344360 , 390709 , 390719
CVE-2021-42258BillQuick Web Suite txtID SQLi340145 , 340156 , 341145 , 341245
CVE-2021-4374WordPress Plugin Automatic Config Change to RCE340145 , 340156 , 341145 , 341245
CVE-2022-0739Wordpress BookingPress bookingpress_front_get_category_services SQLi340016 , 340017 , 340144 , 340156 , 360147 , 360148
CVE-2022-1471PyTorch Model Server Registration and Deserialization RCE337109 , 337110 , 398021 , 398022
CVE-2022-21587Oracle E-Business Suite (EBS) Unauthenticated Arbitrary File Upload330791 , 334168 , 340152 , 390700
CVE-2022-22963Spring Cloud Function SpEL Code Injection (CVE-2022-22963)340011
CVE-2022-24989TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989340006 , 340007 , 344360 , 344364 , 390709 , 390719
CVE-2022-37061FLIR AX8 unauthenticated RCE340128 , 360152 , 380018 , 390801
CVE-2022-39952Fortinet FortiNAC keyUpload.jsp arbitrary file write330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390700 , 390801
CVE-2022-42889Apache Commons Text RCE337209 , 337210 , 337211 , 340014 , 340029 , 340087 , 340095 , 340193 , 344361 , 344363 , 344370 , 380026 , 393655
CVE-2022-43939Pentaho Business Server Auth Bypass and Server Side Template Injection RCE393655
CVE-2023-22515Atlassian Confluence Unauthenticated Remote Code Execution330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801
CVE-2023-3519Citrix ADC (NetScaler) Forms SSO Target RCE340128 , 380018 , 390801
CVE-2023-38096NETGEAR ProSafe Network Management System 300 Arbitrary File Upload334168 , 340156 , 390700
CVE-2023-40498LG Simple Editor Remote Code Execution340006 , 390719
CVE-2023-43177CrushFTP Unauthenticated RCE330791 , 334168 , 340152 , 340156 , 341245
CVE-2023-43654PyTorch Model Server Registration and Deserialization RCE337109 , 337110 , 398021 , 398022
CVE-2024-0204Fortra GoAnywhere MFT Unauthenticated Remote Code Execution330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801
CVE-2024-10924WordPress Really Simple SSL Plugin Authentication Bypass to RCE340128 , 360152 , 390801
CVE-2024-11680ProjectSend r1295 - r1605 Unauthenticated Remote Code Execution330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801
CVE-2024-12847Netgear DGN1000 Setup.cgi Unauthenticated RCE312668
CVE-2024-23897Jenkins cli Ampersand Replacement Arbitrary File Read340006 , 390719
CVE-2024-27198JetBrains TeamCity Unauthenticated Remote Code Execution340128 , 360152 , 380018 , 390700 , 390801
CVE-2024-31026Greek Universities Network (GUnet) Open eClass Platform v.3.15 Arbitrary Code Execution Vulnerability333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2024-3116pgAdmin Binary Path API RCE330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801
CVE-2024-48760GestioIP 3.5.7 Remote Command Execution330791 , 334168 , 340152
CVE-2024-51378CyberPanel Multi CVE Pre-auth RCE390700
CVE-2024-51567CyberPanel Multi CVE Pre-auth RCE390700
CVE-2024-51568CyberPanel Multi CVE Pre-auth RCE390700
CVE-2024-6127PowerShellEmpire Arbitrary File Upload (Skywalker)360152
CVE-2024-7399Samsung MagicINFO 9 Server Remote Code Execution (CVE-2024-7399)344360 , 347009 , 390709
CVE-2024-8503Vicidial SQL Injection Time-based Admin Credentials Enumeration340156
CVE-2026-27966Langflow RCE330791 , 340152
CVE-2026-4257Supsystic Contact Form Wordpress Plugin SSTI RCE393655
CVE-2026-51866Code Injection340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2026-51886Arbitrary Code Execution340014 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2025-34074Lucee Authenticated Scheduled Job Code Execution340128 , 344370 , 360152 , 380018 , 390801
CVE-2025-34104Piwik Superuser Plugin Upload340128 , 360152 , 380018 , 390700 , 390801
CVE-2025-6793Marvell QConvergeConsole Path Traversal (CVE-2025-6793)340007 , 344360 , 347009 , 390709
CVE-2009-20010Dogfood CRM spell.php RCE340014 , 340023 , 340029 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2011-10026Spreecommerce Arbitrary Command Execution340128 , 380018 , 390801
CVE-2012-10036Project Pier Arbitrary File Upload Vulnerability330791 , 334168 , 340152
CVE-2012-10038Auxilium RateMyPet Arbitrary File Upload Vulnerability330791 , 334168 , 340152
CVE-2012-10054Umbraco CMS Remote Command Execution344360 , 344364
CVE-2013-10054LibrettoCMS File Manager Arbitary File Upload Vulnerability330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801
CVE-2013-10055Havalite CMS Arbitary File Upload Vulnerability330791 , 334168 , 340152
CVE-2015-10141xdebug Unauthenticated OS Command Execution340011 , 356331
CVE-2024-14037Redsea Cloud eHR Unauthenticated File Upload RCE via PtFjk.mob351000
CVE-2024-58290Xhibiter NFT Marketplace 1.10.2 SQL Injection via Collections Endpoint340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-34433AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery340128 , 380018 , 390801
CVE-2025-47608Abandoned Cart for WooCommerce SQLi Scanner340156
CVE-2025-59741Multiple vulnerabilities in AndSoft's e-TMS340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655
CVE-2025-66039FreePBX firmware file upload340006 , 340145 , 340156 , 344360 , 390719
CVE-2026-16232Check Point SmartConsole Authentication Bypass Run Script RCE344361 , 344363
CVE-2026-32985Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Template Import330791 , 334168 , 340152
CVE-2026-42208BerriAI LiteLLM Proxy Pre-Auth SQL Injection Scanner340156
CVE-2012-3152Oracle Forms and Reports Remote Code Execution340007 , 344360 , 347009 , 390709
CVE-2025-29927Next.js Middleware Authorization Bypass (CVE-2025-29927)345230
CVE-2026-15896Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter340006 , 340748 , 344360 , 347006 , 390709
CVE-2026-51859bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 Path Traversal Vulnerability344360 , 390709
CVE-2026-51864DB-GPT v0.7.5 and v0.8.0 Path Traversal Vulnerability340007 , 344360 , 390709
CVE-2013-3629ISPConfig Authenticated Arbitrary PHP Code Execution330791 , 334168 , 340152 , 360152
CVE-2014-125125A10 Networks AX Loadbalancer Directory Traversal344360 , 347009 , 390709 , 399125
CVE-2015-3884qdPM v7 Arbitrary PHP File Upload Vulnerability330791 , 334168 , 340133 , 340152
CVE-2017-16524Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 , 399526
CVE-2017-16666Xplico Remote Code Execution330791 , 334168 , 340128 , 340152 , 380018 , 390801
CVE-2017-18048Monstra CMS Authenticated Arbitrary File Upload390700
CVE-2017-5254Cambium ePMP 1000 Account Password Reset340362
CVE-2017-6398Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution344364 , 344366
CVE-2019-1003000Jenkins ACL Bypass and Metaprogramming RCE344361 , 344363
CVE-2019-1003001Jenkins ACL Bypass and Metaprogramming RCE344361 , 344363
CVE-2019-1003002Jenkins ACL Bypass and Metaprogramming RCE344361 , 344363
CVE-2019-1003005Jenkins ACL Bypass and Metaprogramming RCE344361 , 344363
CVE-2019-12169ATutor 2.2.4 - Directory Traversal / Remote Code Execution,340006 , 340007 , 344360 , 347009 , 390709 , 390719
CVE-2020-0618SQL Server Reporting Services (SSRS) ViewState Deserialization340145 , 340156 , 341145 , 341245
CVE-2020-14321Moodle Teacher Enrollment Privilege Escalation to RCE340128 , 360152 , 380018 , 390801
CVE-2020-27386FlexDotnetCMS Arbitrary ASP File Upload340128 , 344370 , 360152 , 380018 , 390801
CVE-2020-27387HorizontCMS Arbitrary PHP File Upload330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801
CVE-2021-43258ChurchInfo 1.2.13-1.3.0 Authenticated RCE330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390700 , 390801
CVE-2022-3405Acronis Cyber Protect/Backup machine info disclosure340011 , 340128 , 380018 , 390801
CVE-2023-27253pfSense Restore RRD Data Command Injection330791 , 340152 , 390700
CVE-2023-32707Splunk "edit_user" Capability Privilege Escalation340128 , 350147 , 360152 , 380018 , 390801
CVE-2023-36969CmsMadeSimple Authenticated File Manager RCE330791 , 334168 , 340152
CVE-2023-38098NETGEAR ProSafe Network Management System 300 Arbitrary File Upload334168 , 340156 , 390700
CVE-2023-40044Progress Software WS_FTP Unauthenticated Remote Code Execution330791 , 340152
CVE-2024-21683Atlassian Confluence Administrator Code Macro Remote Code Execution330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801
CVE-2024-28741NorthStar C2 XSS to Agent RCE340147 , 340148 , 341256 , 341266 , 342259 , 346755 , 350148 , 360030 , 390585
CVE-2024-37032Ollama Model Registry Path Traversal RCE340007 , 344360 , 347009
CVE-2024-48594Prison Management System 1.0 Authenticated RCE via Unrestricted File Upload334168 , 340156 , 390700
CVE-2025-2945pgAdmin Query Tool authenticated RCE (CVE-2025-2945)340145 , 340156 , 341145 , 341245
CVE-2025-34511Sitecore XP CVE-2025-34511 Post-Authentication File Upload330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390700 , 390801
CVE-2026-70650GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and c333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2010-10012Httpdasm Directory Traversal340006 , 347019 , 390709 , 390716
CVE-2012-10034ClanSphere 2011.3 Local File Inclusion Vulnerability340006 , 344360
CVE-2013-10032GetSimpleCMS PHP File Upload Vulnerability330791 , 334168 , 340128 , 340152 , 360152 , 390700 , 390801
CVE-2020-37214Voyager 1.3.0 - Directory Traversal344360 , 347009
CVE-2024-13991Huijietong Cloud Video Platform fileDownload Arbitrary File Read340007 , 344360 , 347009 , 390709
CVE-2024-58388Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.html340007 , 344360 , 347009 , 390709
CVE-2025-34118Linknat Vos Manager Traversal347009
CVE-2025-34126RIPS Scanner Directory Traversal340007 , 344360 , 347009 , 390709
CVE-2025-57790Commvault Command-Line Argument Injection to Traversal Remote Code Execution340006 , 390719
CVE-2025-66294Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE393655
CVE-2026-54049Sakai Conversations has a Stored XSS Issue333140 , 333141 , 340147 , 340148 , 346755
CVE-2026-55230Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character333141 , 340095 , 340247 , 340248 , 342259 , 346755 , 350148
CVE-2026-71542GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php333140 , 333141 , 340095 , 340147 , 346755
CVE-2015-8279Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 , 399526
CVE-2016-1525NETGEAR ProSafe Network Management System 300 Arbitrary File Upload334168 , 340156 , 390700
CVE-2025-61678FreePBX firmware file upload340006 , 344360 , 351000 , 390719
CVE-2025-66301Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE393655
CVE-2026-103766ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-49619Skyvern SSTI Remote Code Execution340128 , 360151 , 380018 , 393655
CVE-2024-58274CSMP iSecure Center OS Command Injection Vulnerability340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2026-103757Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation337109 , 337110 , 344360 , 398021 , 398022
CVE-2026-15983Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 360029 , 390904
CVE-2012-4933Novell ZENworks Asset Management 7.5 Remote File Access340007 , 344360 , 344365 , 390709
CVE-2012-4957NFR Agent SRS Record Arbitrary Remote File Access330791 , 340152
CVE-2018-15710Nagios XI Magpie_debug.php Root Remote Code Execution340128 , 344370 , 360152 , 380018 , 390720 , 390801 , 390904
CVE-2019-9624Webmin Upload Authenticated RCE330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801
CVE-2021-22204GitLab Unauthenticated Remote ExifTool Command Injection330791 , 334168 , 340152
CVE-2026-55232Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022
CVE-2003-0050QuickTime Streaming Server parse_xml.cgi Remote Execution340128 , 360152 , 380018 , 390801
CVE-2006-4602TikiWiki jhot Remote Command Execution340133
CVE-2009-0255TYPO3 sa-2009-001 Weak Encryption Key File Disclosure340007 , 344360 , 347009 , 390709
CVE-2009-3548Apache Tomcat Manager Authenticated Upload Code Execution330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801
CVE-2010-0557Apache Tomcat Manager Authenticated Upload Code Execution330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801
CVE-2011-4166HP Managed Printing Administration jobAcct Remote Command Execution340006 , 340007 , 344360 , 347009 , 390709 , 390719
CVE-2012-5202HP Intelligent Management FaultDownloadServlet Directory Traversal344360 , 344365 , 347009 , 390709
CVE-2012-5203HP Intelligent Management ReportImgServlt Directory Traversal340007 , 344360 , 344365 , 347009 , 390709
CVE-2012-5204HP Intelligent Management IctDownloadServlet Directory Traversal344360 , 344365 , 347009 , 390709
CVE-2012-6329TWiki MAKETEXT Remote Command Execution340011 , 340128 , 380018 , 390801
CVE-2013-0209Movable Type 4.2x, 4.3x Web Upgrade Remote Code Execution340128 , 380018 , 390801
CVE-2013-3520VMware vCenter Chargeback Manager ImageUploadServlet Arbitrary File Upload330791 , 334168 , 340152 , 360152 , 390700
CVE-2014-10021WordPress WP Symposium 14.11 Shell Upload330791 , 334168 , 340152
CVE-2014-5005ManageEngine Desktop Central StatusUpdate Arbitrary File Upload340128 , 360152 , 380018 , 390801
CVE-2014-6446Wordpress InfusionSoft Upload Vulnerability340128 , 360152 , 380018 , 390801
CVE-2014-7146MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801
CVE-2014-7981Joomla weblinks-categories Unauthenticated SQL Injection Arbitrary File Read340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148
CVE-2014-9566Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation340145 , 340156 , 341145 , 341245 , 344370
CVE-2014-9567ProjectSend Arbitrary File Upload330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801
CVE-2015-1172WordPress Holding Pattern Theme Arbitrary File Upload330791 , 334168 , 340152
CVE-2015-1587Maarch LetterBox Unrestricted File Upload330791 , 334168 , 340152
CVE-2016-0752Ruby on Rails Dynamic Render File Upload Remote Code Execution330791 , 334168 , 340152
CVE-2017-5982Kodi 17.0 Local File Inclusion Vulnerability347009
CVE-2019-17199WebPageTest Directory Traversal340007 , 344360 , 347009 , 390709
CVE-2022-24990TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989340006 , 340007 , 344360 , 344364 , 390709 , 390719
CVE-2022-30995Acronis Cyber Protect/Backup machine info disclosure340011 , 340128 , 380018 , 390801
CVE-2023-36661Ivanti Connect Secure Unauthenticated Remote Code Execution337109 , 337110 , 398021 , 398022
CVE-2026-51853agent-zero 1.7, 1.8, 1.9, and 1.10 Path Traversal Vulnerability340007 , 344360 , 390709
CVE-2026-51888Path Traversal340007 , 344360
CVE-2026-92174SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter340007 , 344360 , 390709
CVE-2025-34078NSClient++ 0.5.2.35 - Privilege escalation344370
CVE-2025-68619Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009
CVE-2017-1000119October CMS Upload Protection Bypass Code Execution390700
CVE-2018-1000094CMS Made Simple Authenticated RCE via File Upload/Copy330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390700 , 390801
CVE-2020-25042MaraCMS Arbitrary PHP File Upload330791 , 334168 , 340128 , 340133 , 340152 , 360152 , 380018 , 390801
CVE-2020-8260Pulse Secure VPN gzip RCE340006 , 340007 , 344360 , 390709 , 390719
CVE-2022-1373Softing Secure Integration Server v1.22 Remote Code Execution340006 , 340007 , 344360 , 347009 , 390709
CVE-2022-2334Softing Secure Integration Server v1.22 Remote Code Execution340006 , 340007 , 344360 , 347009 , 390709
CVE-2022-27925Zip Path Traversal in Zimbra (mboximport) (CVE-2022-27925)340007 , 344360 , 347009 , 390709
CVE-2022-43769Pentaho Business Server Auth Bypass and Server Side Template Injection RCE393655
CVE-2024-25641Cacti Import Packages RCE330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801
CVE-2026-55231Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools344360
CVE-2026-92144Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter333140 , 340095 , 342259
CVE-2025-34098Riverbed SteelHead VCX File Read340007 , 344360 , 344370 , 390709
CVE-2026-71426GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field340007 , 344360 , 347009 , 390709
CVE-2023-30804Sangfor Next-Gen Application Firewall Authenticated File Disclosure340007 , 344360 , 347009 , 390709
CVE-2025-34441AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery340128 , 380018 , 390801
CVE-2025-34442AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery340128 , 380018 , 390801
CVE-2025-57788Commvault Command-Line Argument Injection to Traversal Remote Code Execution340006 , 390719
CVE-2025-57791Commvault Command-Line Argument Injection to Traversal Remote Code Execution340006 , 390719
CVE-2008-6132phpScheduleIt PHP reserve.php start_date Parameter Arbitrary Code Injection340011 , 340128 , 340133 , 380018 , 390801
CVE-2013-7102WordPress OptimizePress Theme File Upload Vulnerability340133 , 390700
CVE-2014-9308WordPress WP EasyCart Unrestricted File Upload340128 , 360152 , 380018 , 390700 , 390801
CVE-2015-6967Nibbleblog File Upload Vulnerability390700
CVE-2024-30851Jasmin Ransomware Web Server Unauthenticated Directory Traversal340007 , 344360 , 347009 , 390709
CVE-2025-2292Xorcom CompletePBX Authenticated File Disclosure via Backup Download340006 , 340007 , 344360 , 347009 , 390709
CVE-2014-8598MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801
CVE-2026-101925bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name333140 , 333141 , 340095 , 340147 , 340148 , 346755
CVE-2026-96268Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gd346755
CVE-2026-84925Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-89047Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2009-4098OpenX banner-edit.php File Upload PHP Code Execution330791 , 334168 , 340152 , 360152
CVE-2013-3631NAS4Free Arbitrary Remote Code Execution340006 , 340007 , 344360 , 390709 , 390719
CVE-2014-1610MediaWiki Thumb.php Remote Command Execution330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801
CVE-2020-10977GitLab File Read Remote Code Execution340006 , 340007 , 344360 , 390709 , 390719
CVE-2025-10079PHPGurukul Small CRM get-quote.php sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-10808Campcodes Farm Management System uploadProduct.php sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-14650itsourcecode Online Cake Ordering System product.php sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-14652itsourcecode Online Cake Ordering System admindetail.php sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-15206Campcodes Supplier Management System add_area.php sql injection340017 , 341245 , 380122
CVE-2025-15207Campcodes Supplier Management System view_products.php sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-15208code-projects Refugee Food Management System editrefugee.php sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-15421Yonyou KSOA HTTP GET Parameter agent_worksadd.jsp sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-15424Yonyou KSOA HTTP GET Parameter agent_worksdel.jsp sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-15425Yonyou KSOA HTTP GET Parameter del_user.jsp sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-9925projectworlds Travel Management System detail.php sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2026-103687rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist340007 , 344360 , 347009 , 390709
CVE-2026-104123SourceCodester Online Reviewer Management System btn_functions.php activity sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2019-1622Cisco Data Center Network Manager Unauthenticated Remote Code Execution330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801
CVE-2021-1499Cisco HyperFlex HX Data Platform unauthenticated file upload to RCE (CVE-2021-1499)330791 , 334168 , 340152 , 390700
CVE-2024-58292XMB Forum 1.9.12.06 Persistent Cross-Site Scripting via Admin Templates333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2024-58296CE Phoenix v3.0.1 Stored Cross-Site Scripting via admin/currencies.php333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755
CVE-2024-13992Nagios XI < 2024R1.1 XSS via Missing Page / 404333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2025-59759Multiple vulnerabilities in AndSoft's e-TMS340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655
CVE-2026-55252OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect344365
CVE-2010-4094Apache Tomcat Manager Authenticated Upload Code Execution330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390801
CVE-2011-0063Majordomo2 _list_file_get() Directory Traversal340007 , 399066
CVE-2012-2983Webmin edit_html.cgi file Parameter Traversal Arbitrary File Access340006 , 340007 , 344360 , 347009 , 390709
CVE-2013-4823HP Intelligent Management BIMS DownloadServlet Directory Traversal344360 , 344365 , 347009 , 390709
CVE-2015-2997SysAid Help Desk Arbitrary File Download340007 , 344360 , 347009 , 390709
CVE-2026-7173Multiple vulnerabilities in Entradium by Crocantickets333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-7174Multiple vulnerabilities in Entradium by Crocantickets333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-7175Multiple vulnerabilities in Entradium by Crocantickets333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-7176Multiple vulnerabilities in Entradium by Crocantickets333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755
CVE-2013-3630Moodle Authenticated Spelling Binary RCE340147 , 340148 , 342259 , 346755 , 350148 , 390585
CVE-2012-1465NetDecision NOCVision Server Directory Traversal344365 , 390716
CVE-2013-4341Moodle Authenticated Spelling Binary RCE340147 , 340148 , 342259 , 346755 , 350148 , 390585
CVE-2013-6785Supermicro Onboard IPMI url_redirect.cgi Authenticated Directory Traversal340006 , 340007 , 344360
CVE-2014-2424Oracle Event Processing FileUploadServlet Arbitrary File Upload340006 , 340007 , 344360 , 347009 , 390709 , 390719
CVE-2013-3617Openbravo ERP XXE Arbitrary File Read330791 , 340152
CVE-2025-10845Portabilis i-Educar view sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-10846Portabilis i-Educar edit sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-11611SourceCodester Simple Inventory System user.php sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-12299code-projects Simple Food Ordering System addproduct.php cross site scripting333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2025-13263SourceCodester Online Magazine Management System categories.php sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-15205code-projects Student File Management System download.php sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-15209code-projects Refugee Food Management System editfood.php sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-15210code-projects Refugee Food Management System editrefugee.php sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-15211code-projects Refugee Food Management System refugee.php sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-15423EmpireSoft EmpireCMS connect.php CheckSaveTranFiletype unrestricted upload351000
CVE-2025-9800SimStudioAI sim HTML File route.ts import unrestricted upload351000
CVE-2026-103690itsourcecode Leave Management System controller.php sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2026-104052itsourcecode Pet Shop Management System admin_reject_completed.php sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2025-12224Iqbolshoh php-business-website contact.php cross site scripting333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2025-15414go-sonic Theme Fetching API git_fetcher.go FetchTheme server-side request forgery337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022
CVE-2025-15203SohuTV CacheCloud ResourceController.java index cross site scripting333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2025-15416xnx3 wangmarket Add Global Variable save.do cross site scripting333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2012-6315Movable Type 4.2x, 4.3x Web Upgrade Remote Code Execution340128 , 380018 , 390801