Atomicorp WAF Research Notes
Research Update - 2026-10-03
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2026-26216 | Crawl4AI < 0.8.0 - Unauthenticated Remote Code Execution via Hooks Parameter | 344370 |
| CVE-2026-93698 | cPanel OS Command Injection Vulnerability | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-51861 | bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 Code Injection Vulnerability | 340014 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2023-54405 | H3C CVM Unauthenticated File Upload via fileUpload/upload Token | 351000 |
| CVE-2026-93697 | cPanel Arbitrary Code Execution Vulnerability | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-104462 | YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-104464 | YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter | 337109 , 337110 , 340162 , 340163 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-104851 | fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2014-125130 | CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php | 340007 , 344360 , 347009 , 390709 |
| CVE-2020-37278 | Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFile | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-104460 | YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82039 | UTMStack < 11.2.16 SQL Injection via searchGroupsByFilter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-104471 | YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import | 351000 |
| CVE-2026-104458 | YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390719 , 390722 , 398021 , 398022 |
| CVE-2026-104463 | YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-104450 | YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-51907 | Path Traversal | 340007 , 344360 , 347009 , 390709 |
| CVE-2001-0333 | MS01-026 Microsoft IIS/PWS CGI Filename Double Decode Command Execution | 340193 |
| CVE-2026-103913 | GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-101928 | Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 346755 |
| CVE-2026-102626 | LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-87091 | Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-93756 | Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in A | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-93875 | JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-95670 | No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-96566 | Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-82045 | UTMStack < 11.2.16 JPQL Injection via searchPropertyValues | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-104440 | YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-104441 | YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action | 337109 , 337110 , 340165 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-104442 | YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action | 337109 , 337110 , 340165 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-104459 | YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-12951 | MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-82044 | UTMStack < 11.2.16 Server-Side Request Forgery via downloadPdf | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-103888 | WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-104609 | onetwothreeneth HospitalManagementSystem edit_accounts.php get sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-104637 | onetwothreeneth HospitalManagementSystem controller.php edit_patient unrestricted upload | 351000 , 390501 |
| CVE-2026-7064 | AgentDeskAI browser-tools-mcp browser-connector.ts os command injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-82040 | UTMStack < 11.2.16 SSRF via IdentityProviderService | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-104461 | YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-104465 | YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-104466 | YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute | 333140 , 333141 |
| CVE-2026-104473 | YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2010-2333 | LiteSpeed Source Code Disclosure/Download | 344365 |
| CVE-2011-2474 | Sybase Easerver 6.3 Directory Traversal | 347019 |
| CVE-2026-59659 | Multiple vulnerabilities in the Repasat application | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59660 | Multiple vulnerabilities in the Repasat application | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59661 | Multiple vulnerabilities in the Repasat application | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59662 | Multiple vulnerabilities in the Repasat application | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59663 | Multiple vulnerabilities in the Repasat application | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59664 | Multiple vulnerabilities in the Repasat application | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59665 | Multiple vulnerabilities in the Repasat application | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59666 | Multiple vulnerabilities in the Repasat application | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59667 | Multiple vulnerabilities in the Repasat application | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59668 | Multiple vulnerabilities in the Repasat application | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59669 | Multiple vulnerabilities in the Repasat application | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-59670 | Multiple vulnerabilities in the Repasat application | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59672 | Multiple vulnerabilities in the Repasat application | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-59673 | Multiple vulnerabilities in the Repasat application | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-95662 | Multiple vulnerabilities in the Repasat application | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-104606 | itsourcecode Online Admission System Project confirm.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-104613 | CodeAstro Simple Pharmacy Management System view.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-104614 | CodeAstro Simple Pharmacy Management System delete.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-104625 | CodeAstro Simple Loan Management System index.php sql injection | 340017 , 340145 , 340156 , 340457 , 341245 , 360147 , 360148 , 370016 , 380026 , 380122 , 390572 |