Atomicorp WAF Research Notes
Research Update - 2026-10-07
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2026-106102 | Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead() | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-88416 | MCMS 6.1.1 through 6.2.1 SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-88424 | FineAdmin v1.0 SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-21589 | Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read | 340024 |
| CVE-2026-82531 | Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-105797 | SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport) | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-105985 | Authenticated RCE via render-components Entry Type overrides | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-4889 | SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-24138 | FOG vulnerable to unauthenticated SSRF via /fog/service/getversion.php | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-44716 | Pipecat: Path Traversal in Pipecat Runner /files Endpoint — Arbitrary File Read via %2F-Encoded Separator | 344360 , 347009 , 390709 |
| CVE-2026-82988 | vCast Improper Authentication Vulnerability | 351000 |
| CVE-2026-88392 | Unimall v4 Arbitrary Code Execution Vulnerability | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-21892 | Parsl Monitoring Visualization Vulnerable to SQL Injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-88397 | ApiAdmin 5.0 and Earlier SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-96594 | Gitea repository media API stored XSS | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15140 | saiftheboss7 onlinemcqexam quesadd.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15142 | 9786 phpok3w show.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105776 | bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL admin_transaction.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105918 | Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105919 | Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105920 | Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-106033 | Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-95166 | In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field Cross-Site Scripting Vulnerability | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-22242 | CoreShop Vulnerable to SQL Injection via Admin Reports | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-101029 | Gitea migration and pull mirror SSRF through multi-answer DNS | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-105809 | SourceCodester Simple Student Information System Profile Field register.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105921 | Kusalkasilva Learning-Management-System search_class.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105957 | SourceCodester Performance Indicator System view_product.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15134 | yourmaileyes MOOC Submission MainController.java subreview cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105808 | SourceCodester Simple Student Information System searchresults.php clean cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15145 | SohuTV CacheCloud TotalManageController.java doTotalList cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-15146 | SohuTV CacheCloud UserManageController.java doUserList cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15149 | rawchen ecms Add New Product updateProductServlet.java updateProductServlet cross site scripting | 333140 , 333141 , 340095 , 342259 |