Atomicorp WAF Research Notes
Research Update - 2026-10-04
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2008-3257 | Oracle Weblogic Apache Connector POST Request Buffer Overflow | 390724 |
| CVE-2011-10011 | WeBid converter.php Remote PHP Code Injection | 390614 |
| CVE-2026-41679 | Paperclip AI RCE using a chain of six API calls (CVE-2026-41679). | 330791 , 340152 |
| CVE-2023-45249 | Acronis Cyber Infrastructure default password remote code execution | 330791 , 340145 , 340152 , 340156 , 341145 , 341245 |
| CVE-2013-3576 | HP System Management Homepage JustGetSNMPQueue Command Injection | 340087 , 380026 |
| CVE-2014-9312 | WordPress Photo Gallery Unrestricted File Upload | 330791 , 334168 , 340152 , 382238 |
| CVE-2025-49704 | Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell) | 330906 , 344361 , 344363 , 350147 |
| CVE-2012-10061 | Sockso Music Host Server 1.5 Directory Traversal | 390716 |
| CVE-2026-105123 | W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-11700 | N-able N-Central Authentication Bypass and XXE Scanner | 330791 , 340152 , 344372 |
| CVE-2005-1921 | PHP XML-RPC Arbitrary Code Execution | 344370 , 380026 |
| CVE-2014-4725 | Wordpress MailPoet Newsletters (wysija-newsletters) Unauthenticated File Upload | 330791 , 340152 , 382238 |
| CVE-2014-9707 | Embedthis GoAhead Embedded Web Server Directory Traversal | 347009 |
| CVE-2015-7387 | ManageEngine EventLog Analyzer Remote Code Execution | 340007 , 340145 , 341250 , 344370 |
| CVE-2026-96267 | WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2020-16205 | Geutebruck testaction.cgi Remote Command Execution | 390722 |
| CVE-2020-8816 | Pi-Hole DHCP MAC OS Command Execution | 390763 , 393655 |
| CVE-2025-9316 | N-able N-Central Authentication Bypass and XXE Scanner | 330791 , 340152 , 344372 |
| CVE-2013-5093 | Graphite Web Unsafe Pickle Handling | 344361 , 344363 , 390724 |
| CVE-2025-49706 | Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell) | 330906 , 344361 , 344363 , 350147 |
| CVE-2026-105125 | LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-92974 | Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-103421 | WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105114 | OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-105122 | OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-105124 | W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-105128 | LaraDashboard before 1.4.8 Open Redirect via Email Template Builder redirect_url | 344365 |
| CVE-2014-5266 | Wordpress XMLRPC DoS | 330791 , 340152 , 344372 |
| CVE-2014-5445 | ManageEngine NetFlow Analyzer Arbitrary File Download | 344365 |
| CVE-2014-7816 | WildFly Directory Traversal | 344365 |
| CVE-2026-104983 | Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal | 340007 , 344360 , 390709 |