Atomicorp WAF Research Notes
Research Update - 2026-10-06
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2026-105691 | Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-105697 | Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration | 300008 , 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-105740 | Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-51881 | deeptutor 1.4.0 Code Injection Vulnerability | 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-51884 | The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 Path Traversal Vulnerability | 344360 , 390709 |
| CVE-2026-51911 | vanna v2.0.2 Code Injection Vulnerability | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-88393 | WookTeam 1.6.6 and Earlier Code Injection Vulnerability | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-88395 | GouGuOA 6.0.5 and Earlier SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-66203 | StreamVault is Vulnerable to Authenticated Remote Code Execution (RCE) via ytdlpargs Configuration Injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-51883 | The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 Path Traversal Vulnerability | 340007 , 344360 , 390709 |
| CVE-2026-105762 | Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-104977 | Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebindi | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-105764 | Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-67442 | eve-ng Path Traversal Vulnerability | 340007 , 344360 , 390709 |
| CVE-2026-104973 | Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-105628 | Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-88394 | WookTeam 1.6.6 and Earlier Path Traversal Vulnerability | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-95265 | Feehi CMS 2.1.1 Server-Side Request Forgery Vulnerability | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-73546 | Envoy: Stored XSS in Admin Stats Interface (/stats?format=html) | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2025-68927 | Improper Neutralization of HTML Tags in a Web Page in libredesk | 333140 , 333141 |
| CVE-2026-88396 | ApiAdmin 5.0 and Earlier Arbitrary Code Execution Vulnerability | 351000 |
| CVE-2026-95264 | Feehi CMS 2.1.1 Path Traversal Vulnerability | 340007 , 344360 , 390709 |
| CVE-2025-14312 | Advance WP Query Search Filter <= 1.0.10 - Reflected XSS via counter | 346755 |
| CVE-2025-14313 | Advance WP Query Search Filter <= 1.0.10 - Reflected XSS via taxo_ajax | 346755 |
| CVE-2025-60935 | blitz Open Redirect Vulnerability | 344365 |
| CVE-2025-61782 | Open Redirect in OpenCTI's SAML Authentication Flow | 340165 , 344365 |
| CVE-2025-68951 | phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105689 | Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-105743 | Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTM | 390719 |
| CVE-2025-15109 | jackq XCMS upload.php unrestricted upload | 351000 |
| CVE-2025-15127 | FantasticLBP Hotels_Server Room.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15181 | code-projects Refugee Food Management System pagenateRefugeesList.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15182 | code-projects Refugee Food Management System served.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15183 | code-projects Refugee Food Management System viewtakenfd.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15184 | code-projects Refugee Food Management System refugeesreport2.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15185 | code-projects Refugee Food Management System refugeesreport.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15186 | code-projects Refugee Food Management System addusers.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15195 | code-projects Assessment Management add-module.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15196 | code-projects Assessment Management login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15198 | code-projects College Notes Uploading System login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15243 | code-projects Simple Stock System login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105246 | SourceCodester Online Reviewer Management System btn_functions.php update sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 , 390572 |
| CVE-2026-105247 | SourceCodester Online Reviewer Management System btn_functions.php course sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 , 390572 |
| CVE-2026-105253 | itsourcecode Online Admission System Project login1.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105290 | feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-105383 | onetwothreeneth HospitalManagementSystem controller.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105384 | UNION HospitalManagementSystem patient_info.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105385 | onetwothreeneth HospitalManagementSystem transaction_details.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105386 | onetwothreeneth HospitalManagementSystem print.php get sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105468 | girishsaraf Online-Appointment-Booking-System Login mlogin.php mysqli_query sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105469 | girishsaraf Online-Appointment-Booking-System AJAX Endpoint get_town.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105471 | girishsaraf Online-Appointment-Booking-System Registration signup.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-65590 | nopcommerce Cross-Site Scripting Vulnerability | 333140 , 333141 |
| CVE-2026-102295 | Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-105694 | Penpot: Stored XSS via Unsanitised SVG Uploads | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105263 | Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2023-39999 | WordPress < 6.3.2 is vulnerable to Broken Access Control | 333140 |
| CVE-2025-69206 | Hemmelig has SSRF Filter bypass in Secret Request functionality | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-102576 | Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15129 | ChenJinchuang Lin-CMS-TP5 File Upload LocalUploader.php upload code injection | 351000 |
| CVE-2025-15220 | SohuTV CacheCloud LoginController.java init cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105254 | itsourcecode Online Admission System schoolyear.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105286 | Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal | 344360 , 390709 |
| CVE-2026-105287 | feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105288 | feelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105291 | feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting | 333140 , 333141 , 340087 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105329 | TallCMS PluginManager ThemeManager.php code injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390719 , 393655 |
| CVE-2026-105388 | feelec-yishu feelcrm-os Member Endpoint MemberController.class.php index sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105389 | feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload | 351000 |
| CVE-2026-105438 | O2OA General url ActionUploadExcelWithUrl server-side request forgery | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-105705 | SourceCodester Drug Recommendation System add_drug.php cross site scripting | 346755 |
| CVE-2026-105708 | imgproxy SVG svg.go sanitizeElement cross site scripting | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-7700 | langflow-ai langflow LambdaFilterComponent lambda_filter.py eval code injection | 390716 , 390719 |
| CVE-2025-15110 | jackq XCMS Backend ProductImageController.class.php upload unrestricted upload | 351000 |
| CVE-2025-15130 | shanyu SyCms Administrative Panel FileManageController.class.php addPost code injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2025-15148 | CmsEasy Backend Template Management template_admin.php savetemp_action code injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-15174 | SohuTV CacheCloud AppManageController.java doAppAuditList cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15175 | SohuTV CacheCloud AppController.java appCommandAnalysis cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15197 | code-projects/anirbandutta9 Content Management System/News-Buzz editposts.php unrestricted upload | 351000 |
| CVE-2025-15221 | SohuTV CacheCloud AppDataMigrateController.java index cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15241 | CloudPanel Community Edition HTTP Header users redirect | 344365 |
| CVE-2026-105289 | feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripti | 333140 , 340095 , 340147 , 341256 , 342259 , 346755 |
| CVE-2025-15188 | Campcodes Complete Online Beauty Parlor Management System search-invoices.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 |