Atomicorp WAF Research Notes
Research Update - 2026-10-08
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2011-1900 | Indusoft WebStudio NTWebServer Remote File Access | 344365 , 390716 |
| CVE-2013-4811 | HP ProCurve Manager SNAC UpdateDomainControllerServlet File Upload | 340006 , 390719 |
| CVE-2013-4812 | HP ProCurve Manager SNAC UpdateCertificatesServlet File Upload | 340006 , 390719 |
| CVE-2015-5082 | Endian Firewall Proxy Password Change Command Injection | 330791 , 340152 |
| CVE-2026-85706 | GitLab Unauthenticated Arbitrary File Read | 340007 , 344360 , 347009 , 390709 , 398120 |
| CVE-2026-32306 | OneUptime ClickHouse SQL Injection via Aggregate Query Parameters | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2014-8516 | Visual Mining NetCharts Server Remote Code Execution | 334168 |
| CVE-2014-8741 | Lexmark MarkVision Enterprise Arbitrary File Upload | 340006 , 390719 |
| CVE-2018-5999 | AsusWRT LAN Unauthenticated Remote Code Execution | 330791 , 334168 , 340152 |
| CVE-2018-6000 | AsusWRT LAN Unauthenticated Remote Code Execution | 330791 , 334168 , 340152 |
| CVE-2019-20361 | WordPress Email Subscribers and Newsletter Hash SQLi Scanner | 340145 , 340156 , 341145 , 341245 |
| CVE-2024-8517 | SPIP BigUp Plugin Unauthenticated RCE | 330791 , 334168 , 340152 |
| CVE-2025-14344 | Multi Uploader for Gravity Forms <= 1.1.7 - Unauthenticated Arbitrary File Deletion | 340007 , 344360 , 390709 |
| CVE-2026-77647 | SPIP X-Spip-Filtre Unauthenticated RCE | 390722 |
| CVE-2026-85097 | Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter | 351000 |
| CVE-2025-67744 | Mermaid XSS vulnerability leads to Remote Code Execution | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2020-17132 | Microsoft Exchange Server DlpUtils AddTenantDlpPolicy RCE | 330791 , 340152 |
| CVE-2023-5350 | SuiteCRM authenticated SQL injection in export functionality | 340145 , 340156 , 341145 , 341245 |
| CVE-2026-51862 | DB-GPT 0.8.0 Path Traversal Vulnerability | 340007 , 344360 , 390709 |
| CVE-2026-51882 | The OpenAI-compatible file upload endpoint /v1/files in Langchain-Chatchat 0.3.0 Path Traversal Vulnerability | 344360 , 390709 |
| CVE-2014-5468 | Railo Remote File Include | 344360 , 347009 |
| CVE-2017-7411 | Tuleap 9.6 Second-Order PHP Object Injection | 340011 , 340128 , 380018 , 390801 |
| CVE-2018-25163 | BitZoom 1.0 SQL Injection via rollno Parameter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25171 | EdTv 2 SQL Injection via id Parameter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-25196 | ServerZilla 1.0 SQL Injection via email Parameter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 , 390572 |
| CVE-2018-25197 | PlayJoom 0.10.1 SQL Injection via catid Parameter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-15949 | Nagios XI Prior to 5.6.6 getprofile.sh Authenticated Remote Command Execution | 330791 , 334168 , 340152 |
| CVE-2019-25578 | phpTransformer 2016.9 SQL Injection via GeneratePDF.php | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-25580 | ownDMS 4.7 SQL Injection via pdfstream.php imagestream.php | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2023-0315 | Froxlor Log Path RCE | 330791 , 340152 |
| CVE-2024-37404 | Ivanti Connect Secure Authenticated Remote Code Execution via OpenSSL CRLF Injection | 344361 , 344363 |
| CVE-2025-52664 | revive adserver SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 , 390572 |
| CVE-2025-66449 | ConvertX has Path Traversal that leads to Arbitrary File Write and Arbitrary Code Execution | 340007 , 344360 , 390709 |
| CVE-2026-17196 | Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 360029 , 390904 |
| CVE-2012-10042 | Sflog! CMS 1.0 Arbitrary File Upload Vulnerability | 330791 , 334168 , 340133 , 340152 |
| CVE-2025-34179 | NetSupport Manager < 14.12.0001 Unauthenticated SQLi Local File Disclosure | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-34181 | NetSupport Manager < 14.12.0001 Authenticated Path Traversal Arbitrary File Write RCE | 344360 , 390709 |
| CVE-2025-40639 | SQL injection in Eventobot | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-33226 | Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-10655 | Frappe Helpdesk 1.14.0 — SQL Injection in dashboard get_dashboard_data | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13417 | Plugin Organizer < 10.2.4 - Subscriber+ SQLi | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2025-61675 | FreePBX endpoint SQLi to RCE | 340145 , 340156 |
| CVE-2020-16875 | Microsoft Exchange Server DlpUtils AddTenantDlpPolicy RCE | 330791 , 340152 |
| CVE-2025-45871 | LogicalDOC Enterprise up to and for 9.1.1 SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-50286 | Grav CMS Admin Direct Install Authenticated Plugin Upload RCE | 330791 , 334168 , 340152 |
| CVE-2026-62251 | Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2023-0872 | OpenNMS Horizon Authenticated RCE | 330791 , 340152 |
| CVE-2023-40315 | OpenNMS Horizon Authenticated RCE | 330791 , 340152 |
| CVE-2026-32308 | OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 |
| CVE-2021-21975 | VMware vRealize Operations (vROps) Manager SSRF RCE | 334168 |
| CVE-2026-51852 | agent-zero 1.7, 1.8, 1.9, and 1.10 Path Traversal Vulnerability | 340007 , 344360 , 390709 |
| CVE-2025-12835 | WooMulti <= 1.7 - Subscriber+ Arbitrary File Deletion | 340748 , 344360 , 347006 , 390709 |
| CVE-2017-12636 | Apache CouchDB Arbitrary Command Execution | 341245 |
| CVE-2018-19422 | Intelliants Subrion CMS 4.2.1 - Authenticated File Upload Bypass to RCE | 330791 , 334168 , 340152 |
| CVE-2020-5741 | Plex Unpickle Dict Windows RCE | 344365 |
| CVE-2025-10686 | Creta Testimonial Showcase < 1.2.4 - Editor+ Local File Inclusion | 340007 , 344360 , 390709 |
| CVE-2025-12135 | WPBookit <= 1.0.6 - Unauthenticated Stored Cross-Site Scripting | 346755 |
| CVE-2025-12399 | Alex Reservations: Smart Restaurant Booking <= 2.2.3 - Authenticated (Admin+) Arbitrary File Upload | 351000 |
| CVE-2025-68109 | ChurchCRM Database Restore RCE 6.2.0 | 330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390801 , 390904 |
| CVE-2025-68916 | netman 208 Path Traversal Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-89417 | OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12684 | URL Shortify < 1.11.3 - Reflected XSS | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2025-13071 | Custom Admin Menu <= 1.0.0 - Reflected XSS | 340087 , 340099 , 341099 , 341266 |
| CVE-2025-13355 | URL Shortify < 1.11.4 - Reflected XSS | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2025-8385 | Zombify <= 1.7.5 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read | 340007 , 344360 , 347009 , 390709 |
| CVE-2014-8499 | ManageEngine Password Manager SQLAdvancedALSearchResult.cc Pro SQL Injection | 340145 , 340156 , 341145 , 341245 |
| CVE-2015-2994 | SysAid Help Desk Administrator Portal Arbitrary File Upload | 340006 , 390719 |
| CVE-2021-21983 | VMware vRealize Operations (vROps) Manager SSRF RCE | 334168 |
| CVE-2024-57487 | Car Rental System 1.0 File Upload RCE (Authenticated) | 330791 , 334168 , 340152 |
| CVE-2025-64114 | ClipBucket v5: SQL Injection possible through ClipBucket Custom Fields plugin | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13135 | HotelRunner Booking Widget <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-14387 | LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_soc | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-34076 | Microweber CMS v1.2.10 Local File Inclusion (Authenticated) | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-13439 | Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserializatio | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390722 |
| CVE-2025-12928 | code-projects Online Job Search Engine login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12929 | SourceCodester Survey Application System LoginRegistration.php update_user sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12938 | projectworlds Online Admission System process_login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13121 | cameasy Liketea API Endpoint StoreController.php list sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13169 | code-projects Simple Online Hotel Reservation System add_query_reserve.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13201 | code-projects Simple Cafe Ordering System login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340155 , 340156 , 340157 , 341145 , 341155 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13203 | code-projects Simple Cafe Ordering System addmem.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13257 | itsourcecode Inventory Management System index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13261 | lsfusion platform DownloadFileRequestHandler.java DownloadFileRequestHandler path traversal | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-13262 | lsfusion platform UploadFileRequestHandler.java UploadFileRequestHandler path traversal | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-13266 | wwwlike vlife VLifeApi SysFileApi.java create path traversal | 344360 , 390709 |
| CVE-2025-13271 | Campcodes School Fees Payment Management System ajax.php sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2025-13272 | Campcodes School Fees Payment Management System manage_course.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13280 | CodeAstro Simple Inventory System Login index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13285 | itsourcecode Online Voting System login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13297 | itsourcecode Web-Based Internet Laboratory Management System controller.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13298 | itsourcecode Web-Based Internet Laboratory Management System controller.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13299 | itsourcecode Web-Based Internet Laboratory Management System controller.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13300 | itsourcecode Web-Based Internet Laboratory Management System controller.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13301 | itsourcecode Web-Based Internet Laboratory Management System controller.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13782 | taosir WTCMS SlideController SlideController.class.php delete sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14209 | Campcodes School File Management System update_query.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14210 | projectworlds Advanced Library Management System delete_member.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14211 | projectworlds Advanced Library Management System delete_book.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14212 | projectworlds Advanced Library Management System member_search.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14215 | code-projects Currency Exchange System edit.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14216 | code-projects Currency Exchange System viewserial.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14217 | code-projects Currency Exchange System edittrns.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14218 | code-projects Currency Exchange System editotheraccount.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14223 | code-projects Simple Leave Manager request.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14226 | itsourcecode Student Management System edit_user.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14248 | code-projects Simple Shopping Cart adminlogin.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14249 | code-projects Online Ordering System user_school.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14250 | code-projects Online Ordering System user_contact.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14251 | code-projects Online Ordering System Admin Login admin sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14256 | itsourcecode Student Management System newcurriculm.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14257 | itsourcecode Student Management System newrecord.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14285 | code-projects Employee Profile Management System edit_personnel.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14527 | projectworlds Advanced Library Management System view_book.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14529 | Campcodes Retro Basketball Shoes Online Store admin_running.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14536 | code-projects Class and Exam Timetable Management Login index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14537 | code-projects Class and Exam Timetable Management preview7.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14565 | kidaze CourseSelectionSystem login1.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14566 | kidaze CourseSelectionSystem reg.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14570 | projectworlds Advanced Library Management System view_admin.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14571 | projectworlds Advanced Library Management System borrow_book.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14578 | itsourcecode Student Management System update_account.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14583 | campcodes Online Student Enrollment System register.php unrestricted upload | 351000 |
| CVE-2025-14584 | itsourcecode COVID Tracking System Admin Login login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14585 | itsourcecode COVID Tracking System page sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14587 | itsourcecode Online Pet Shop Management System available.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14588 | itsourcecode Student Management System update_program.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14590 | code-projects Prison Management System search1.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14637 | itsourcecode Online Pet Shop Management System addcnp.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14638 | itsourcecode Online Pet Shop Management System update_cnp.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14639 | itsourcecode Student Management System uprec.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14643 | code-projects Simple Attendance Record System check.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14644 | itsourcecode Student Management System update_subject.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14649 | itsourcecode Online Cake Ordering System supplier.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14653 | itsourcecode Student Management System addrecord.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14661 | itsourcecode Student Managemen System advisers.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14710 | FantasticLBP Hotels Server OrderList.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14711 | FantasticLBP Hotels Server hotelList.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15073 | itsourcecode Online Frozen Foods Ordering System contact_us.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15074 | itsourcecode Online Frozen Foods Ordering System customer_details.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15075 | itsourcecode Student Management System student_p.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15077 | itsourcecode Student Management System form137.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15078 | itsourcecode Student Management System list_report.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15165 | itsourcecode Online Cake Ordering System updatecustomer.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15166 | itsourcecode Online Cake Ordering System updatesupplier.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15167 | itsourcecode Online Cake Ordering System detailtransac.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15168 | itsourcecode Student Management System statistical.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11363 | Royal Elementor Addons and Templates < 1.7.1037 - Unauthenticated Media File Upload | 351000 |
| CVE-2025-12655 | Hippoo Mobile App for WooCommerce <= 1.7.1 - Missing Authorization to Unauthenticated Limited File Write | 351000 |
| CVE-2025-15152 | h-moses moga-mall PmsProductController.java addProduct unrestricted upload | 340007 , 344360 , 390709 |
| CVE-2025-34504 | KodExplorer 4.52 Open Redirect Vulnerability via User Login Endpoint | 344365 |
| CVE-2025-66452 | LibreChat's lack of JSON parsing error handling can lead to XSS | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-68914 | netman 208 SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-107273 | Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-40638 | Reflected Cross-Site Scripting (XSS) in Eventobot | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-40681 | Cross-Site Scripting (XSS) in xCally Omnichannel | 333140 , 333141 , 340087 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 346755 |
| CVE-2025-41107 | Stored XSS in Smart School | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-64115 | Movary unvalidated Referer header allows open redirect and phishing | 344365 |
| CVE-2025-64116 | Movary vulnerable to an open redirect | 344365 |
| CVE-2025-64716 | Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2013-4826 | HP Intelligent Management SOM FileDownloadServlet Arbitrary Download | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-14477 | 404 Solution <= 3.1.0 - Authenticated (Admin+) SQL Injection via 'filterText' Parameter | 340017 , 340156 |
| CVE-2025-68915 | netman 208 Cross-Site Scripting Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12494 | Image Gallery – Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Imag | 340007 , 344360 , 390709 |
| CVE-2025-10583 | WP Fastest Cache Premium <= 1.7.4 - Missing Authorization to Authenticated (Subscriber+) Blind Server-Side Request Forge | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-107449 | Heimdall Server-Side Request Forgery Vulnerability | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-14276 | Ilevia EVE X1 Server leaf_search.php command injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 |
| CVE-2025-12862 | projectworlds Online Notes Sharing Platform userprofile.php unrestricted upload | 351000 |
| CVE-2025-12922 | OpenClinica Community Edition CRF Data Import ImportCRFData path traversal | 340007 , 344360 , 390709 |
| CVE-2025-12930 | SourceCodester Food Ordering System view-ticket.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12931 | SourceCodester Food Ordering System edit-orders.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12933 | SourceCodester Baby Care System updatewelcome.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12939 | SourceCodester Interview Management System addCandidate.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13172 | CodeAstro Gym Management System view-member-report.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13208 | FantasticLBP Hotels Server hotelList.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13209 | bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference | 330791 , 340152 , 344360 , 344370 , 344372 , 344373 , 380018 |
| CVE-2025-13253 | projectworlds Advanced Library Management System add_librarian.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13254 | projectworlds Advanced Library Management System add_member.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13255 | projectworlds Advanced Library Management System book_search.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13256 | projectworlds Advanced Library Management System borrow.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13259 | Campcodes Supplier Management System edit_unit.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13260 | Campcodes Supplier Management System edit_product.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13264 | SourceCodester Online Magazine Management System view_magazine.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13267 | SourceCodester Dental Clinic Appointment Reservation System success.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13269 | Campcodes School Fees Payment Management System ajax.php sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2025-13270 | Campcodes School Fees Payment Management System ajax.php sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2025-13273 | Campcodes School Fees Payment Management System ajax.php sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2025-13274 | Campcodes School Fees Payment Management System ajax.php sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2025-13278 | projectworlds Advanced Library Management System borrowed_book_search.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13286 | itsourcecode Online Voting System ajax.php sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2025-13287 | itsourcecode Online Voting System index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13303 | code-projects Courier Management System search-edit.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14182 | Sobey Media Convergence System upload path traversal | 340007 , 344360 , 390709 |
| CVE-2025-14193 | code-projects Employee Profile Management System view_personnel.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14195 | code-projects Employee Profile Management System add_file_query.php unrestricted upload | 351000 |
| CVE-2025-14214 | itsourcecode Student Information System section_edit1.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14222 | code-projects Employee Profile Management System print_personnel_report.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14227 | Philipinho Simple-PHP-Blog edit.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14230 | code-projects Daily Time Recording System add_payroll.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14246 | code-projects Simple Shopping Cart settings.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14247 | code-projects Simple Shopping Cart additems.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14259 | Jihai Jshop MiniProgram Mall System api.html sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14520 | baowzh hfly delfile path traversal | 344360 , 347009 |
| CVE-2025-14521 | baowzh hfly download path traversal | 344360 , 347009 |
| CVE-2025-14522 | baowzh hfly upload_json.php unrestricted upload | 351000 |
| CVE-2025-14568 | haxxorsid Stock-Management-System User.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14589 | code-projects Prison Management System search.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14731 | CTCMS Content Management System Frontend/Template Management CT_Parser.php special elements used in a template engine | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-15088 | ketr JEPaaS loadPostil postilService.loadPostils sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 , 390572 |
| CVE-2025-15093 | sunkaifei FlyCMS Admin Login IndexAdminController.java cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15144 | dayrui XunRuiCMS JSONP Callback Init.php dr_exit_msg cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12546 | LogicalDOC Community Edition API Key creation UI cross site scripting | 333140 , 333141 |
| CVE-2025-12853 | SourceCodester Best House Rental Management System admin_class.php delete_house sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2025-12855 | code-projects Responsive Hotel Site newsletterdel.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12856 | code-projects Responsive Hotel Site reservation.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380122 , 390572 |
| CVE-2025-12857 | code-projects Responsive Hotel Site roombook.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12913 | code-projects Responsive Hotel Site roomdel.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12914 | aaPanel BaoTa Backend database sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12923 | liweiyi ChestnutCMS download resourceDownload path traversal | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-12932 | SourceCodester Baby Care System admin.php sql injection | 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13182 | pojoin h3blog addtitle cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 |
| CVE-2025-13210 | itsourcecode Inventory Management System index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13302 | code-projects Courier Management System add-new-officer.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14194 | code-projects Employee Profile Management System view_personnel.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-14219 | Campcodes Retro Basketball Shoes Online Store admin_running.php unrestricted upload | 351000 |
| CVE-2025-14530 | SourceCodester Real Estate Property Listing App property.php unrestricted upload | 351000 |
| CVE-2025-14538 | yangshare warehouseManager 仓库管理系统 CustomerManageHandler.java addCustomer cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-14582 | campcodes Online Student Enrollment System index.php unrestricted upload | 351000 |
| CVE-2025-14694 | ketr JEPaaS readAllPostil sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 , 390572 |
| CVE-2025-14729 | CTCMS Content Management System Backend App Configuration Ct_App.php save code injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-14730 | CTCMS Content Management System Backend System Configuration Ct_Config.php code injection | 340014 , 340029 , 340095 , 340128 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 380018 , 390801 , 393655 |
| CVE-2025-15171 | SohuTV CacheCloud ServerController.java index cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15172 | SohuTV CacheCloud RedisConfigTemplateController.java preview cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15173 | SohuTV CacheCloud InstanceController.java advancedAnalysis cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15201 | SohuTV CacheCloud WebResourceController.java redirectNoPower cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-15200 | SohuTV CacheCloud AppClientDataShowController.java doIndex cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |