Atomicorp WAF Research Notes
Research Update - 2026-10-10
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2010-4279 | Pandora FMS v3.1 Auth Bypass and Arbitrary File Upload Vulnerability | 390700 |
| CVE-2011-0266 | HP OpenView NNM nnmRptConfig nameParams Buffer Overflow | 344365 , 392647 |
| CVE-2011-0267 | HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow | 392647 |
| CVE-2012-0297 | Symantec Web Gateway 5.0.2.8 relfile File Inclusion Vulnerability | 340007 , 344360 |
| CVE-2012-0299 | Symantec Web Gateway 5.0.2.8 Arbitrary PHP File Upload Vulnerability | 390700 |
| CVE-2013-10040 | ClipBucket Remote Code Execution | 336460 , 340128 , 360152 , 380018 , 390801 |
| CVE-2013-10066 | Kordil EDMS v2.2.60rc3 Unauthenticated Arbitrary File Upload Vulnerability | 330791 , 334168 , 340152 |
| CVE-2013-10070 | PHP-Charts v1.0 PHP Code Execution Vulnerability | 340087 , 340128 , 380018 , 390801 , 393655 |
| CVE-2015-2284 | Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability | 330791 , 334168 , 340128 , 340133 , 340152 , 360152 , 380018 , 390801 |
| CVE-2017-6326 | Symantec Messaging Gateway Remote Code Execution | 344364 , 380026 , 393655 |
| CVE-2025-34112 | Riverbed SteelCentral NetProfiler/NetExpress Remote Code Execution | 341245 |
| CVE-2012-1495 | WebCalendar 1.2.4 Pre-Auth Remote Code Injection | 340095 , 360152 , 380026 |
| CVE-2012-2576 | Solarwinds Storage Manager 5.1.0 SQL Injection | 340016 , 340017 , 340145 , 340156 , 340157 , 340159 , 341145 , 341245 , 344370 , 360147 , 360148 , 390572 |
| CVE-2012-6710 | eXtplorer v2.1 Arbitrary File Upload Vulnerability | 340128 , 360152 , 380018 , 390700 , 390801 |
| CVE-2013-5743 | Zabbix 2.0.8 SQL Injection and Remote Code Execution | 331028 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 |
| CVE-2015-8249 | ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability | 340007 , 340128 , 344370 , 360152 , 380018 , 390614 , 390801 |
| CVE-2016-8582 | AlienVault OSSIM/USM Remote Code Execution | 340145 , 340156 , 340157 , 340159 , 341145 , 341245 , 360147 , 360148 , 380026 |
| CVE-2017-14706 | DenyAll Web Application Firewall Remote Code Execution | 344364 , 393655 |
| CVE-2018-12464 | MicroFocus Secure Messaging Gateway Remote Code Execution | 340145 , 340156 , 341145 , 341245 , 344361 , 344364 , 393655 |
| CVE-2018-7665 | ClipBucket beats_uploader Unauthenticated Arbitrary File Upload | 330791 , 334168 , 340152 |
| CVE-2018-7890 | ManageEngine Applications Manager Remote Code Execution | 340145 , 340156 , 341145 , 341245 , 393655 |
| CVE-2018-9206 | blueimp's jQuery (Arbitrary) File Upload | 330791 , 334168 , 340152 |
| CVE-2019-11231 | GetSimpleCMS Unauthenticated RCE | 340128 , 360152 , 380018 , 390801 |
| CVE-2026-103889 | 3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2013-10043 | Astium Remote Code Execution | 340145 , 340156 , 341145 , 341245 , 390700 |
| CVE-2012-10039 | ZEN Load Balancer Filelog Command Execution | 330925 |
| CVE-2013-10067 | Glossword v1.8.8 - 1.8.12 Arbitrary File Upload Vulnerability | 330791 , 334168 , 340152 |
| CVE-2012-10045 | XODA 0.4.5 Arbitrary PHP File Upload Vulnerability | 330791 , 334168 , 340152 |
| CVE-2012-10049 | WebPageTest Arbitrary PHP File Upload | 330791 , 334168 , 340152 |
| CVE-2012-10050 | CuteFlow v2.11.2 Arbitrary File Upload Vulnerability | 330791 , 334168 , 340152 |
| CVE-2012-10052 | EGallery PHP File Upload Vulnerability | 330791 , 334168 , 340152 |
| CVE-2013-10033 | Kimai v0.9.2 'db_restore.php' SQL Injection | 340016 , 340017 , 340145 , 340156 , 340157 , 341145 , 341245 , 344370 , 360147 , 360148 , 380025 |
| CVE-2013-10038 | FlashChat Arbitrary File Upload | 330791 , 334168 , 340152 |
| CVE-2013-10047 | MiniWeb (Build 300) Arbitrary File Upload | 330791 , 340006 , 340152 , 390719 , 398110 |
| CVE-2025-34100 | BuilderEngine Arbitrary File Upload Vulnerability and execution | 340006 , 340007 , 344360 , 347009 , 390709 , 390719 , 399069 |
| CVE-2025-34102 | Crypttech CryptoLog Remote Code Execution | 340145 , 340156 , 341145 , 341245 , 344364 , 393655 |
| CVE-2026-108107 | PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2014-125126 | Simple E-Document Arbitrary File Upload | 334168 , 340156 , 390700 |
| CVE-2015-3628 | F5 iControl iCall::Script Root Command Execution | 344363 |
| CVE-2015-10144 | WordPress Responsive Thumbnail Slider Arbitrary File Upload | 330791 , 334168 , 340152 , 382238 |
| CVE-2017-11391 | Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution | 344364 , 390716 , 393655 |
| CVE-2017-11392 | Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution | 344364 , 390716 , 393655 |
| CVE-2017-5255 | Cambium ePMP1000 'ping' Shell via Command Injection (up to v2.5) | 340362 , 391213 |
| CVE-2017-5259 | Cambium cnPilot r200/r201 Command Execution as 'root' | 344360 , 347009 , 390904 , 392647 |
| CVE-2019-10867 | Pimcore Unserialize RCE | 344366 , 346755 , 390801 |
| CVE-2019-12799 | Shopware createInstanceFromNamedArguments PHP Object Instantiation RCE | 341256 , 344360 , 347009 , 390719 , 398007 |
| CVE-2019-16113 | Bludit Directory Traversal Image File Upload Vulnerability | 330791 , 340006 , 340152 , 344360 |
| CVE-2025-59939 | WeGIA vulnerable to SQL Injection into method excluir of the ProdutoControle class in the parameter id_produto. | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2012-10056 | PHP Volunteer Management System v1.0.2 Arbitrary File Upload Vulnerability | 330791 , 334168 , 340152 |
| CVE-2013-10035 | ProcessMaker Open Source Authenticated PHP Code Execution | 344361 , 344363 |
| CVE-2013-10044 | OpenEMR 4.1.1 Patch 14 SQLi Privilege Escalation Remote Code Execution | 331028 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 |
| CVE-2026-108101 | HortusFox through 6.3 Unrestricted File Upload via Plant Attachments | 351000 |
| CVE-2008-5191 | SePortal SQLi Remote Code Execution | 331028 , 334168 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 390700 |
| CVE-2009-4140 | OpenEMR PHP File Upload Vulnerability | 336460 , 340128 , 360152 , 380018 , 390801 , 392301 |
| CVE-2010-4417 | Oracle BeeHive 2 voice-servlet processEvaluation() Vulnerability | 340087 , 340095 , 340128 , 350147 , 360152 , 380018 , 390614 , 390801 |
| CVE-2013-1349 | OpenSIS 'modname' PHP Code Execution | 340128 , 344370 , 380018 , 390801 |
| CVE-2013-5967 | AlienVault Authenticated SQL Injection Arbitrary File Read | 331028 , 340016 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 |
| CVE-2014-7228 | Joomla Akeeba Kickstart Unserialize Remote Code Execution | 390613 , 390614 |
| CVE-2015-7857 | Joomla Content History SQLi Remote Code Execution | 331028 , 340016 , 340017 , 340145 , 340157 , 340159 , 341145 , 341245 , 360147 , 360148 , 380026 , 390501 |
| CVE-2015-7858 | Joomla Content History SQLi Remote Code Execution | 331028 , 340016 , 340017 , 340145 , 340157 , 340159 , 341145 , 341245 , 360147 , 360148 , 380026 , 390501 |
| CVE-2026-107812 | Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or M | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2018-12465 | MicroFocus Secure Messaging Gateway Remote Code Execution | 340145 , 340156 , 341145 , 341245 , 344361 , 344364 , 393655 |
| CVE-2025-62423 | ClipBucket V5 Blind SQL injection in the Admin Panel | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-93775 | Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-2928 | F5 iControl Remote Root Command Execution | 344361 , 344363 , 344364 , 344370 |
| CVE-2026-108100 | HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-108158 | plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-11864 | NucleoidAI Nucleoid Outbound Request cluster.ts extension.apply server-side request forgery | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-62662 | Stored XSS through system messages in AdvancedSearch | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62663 | Stored XSS through a system message in UploadWizard | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62664 | Stored XSS through a system message in ImageRating | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62670 | Stored XSS through a system message in FlexDiagrams | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62671 | Stored XSS through wikitext in Cargo | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2012-1153 | appRain CMF Arbitrary PHP File Upload Vulnerability | 330791 , 340152 , 390700 |
| CVE-2013-5576 | Joomla Media Manager File Upload Vulnerability | 330791 , 340152 |
| CVE-2015-2995 | SysAid Help Desk 'rdslogs' Arbitrary File Upload | 340007 , 340128 , 344370 , 360152 , 380018 , 390613 , 390614 , 390801 |
| CVE-2011-4350 | Yaws Web Server Directory Traversal | 340006 , 344365 , 347019 , 390716 |
| CVE-2012-0938 | TestLink v1.9.3 Arbitrary File Upload Vulnerability | 330791 , 334168 , 340016 , 340017 , 340144 , 340145 , 340152 , 340156 , 340157 , 340159 , 341145 , 341245 , 360147 , 360148 |
| CVE-2012-2962 | Dell SonicWALL (Plixer) Scrutinizer 9 SQL Injection | 340007 , 340016 , 340017 , 340157 , 340159 , 341245 , 344370 , 360147 , 360148 |
| CVE-2014-2238 | MantisBT Admin SQL Injection Arbitrary File Read | 340016 , 340017 , 340144 , 340157 , 360147 , 360148 |
| CVE-2014-5383 | AlienVault Authenticated SQL Injection Arbitrary File Read | 331028 , 340016 , 340156 , 341245 , 360148 , 380026 |
| CVE-2014-7285 | Symantec Web Gateway 5 restore.php Post Authentication Command Injection | 390700 |
| CVE-2015-5603 | Atlassian HipChat for Jira Plugin Velocity Template Injection | 337206 , 337210 , 344370 |
| CVE-2017-18357 | Shopware createInstanceFromNamedArguments PHP Object Instantiation RCE | 341256 , 344360 , 347009 , 390719 , 398007 |
| CVE-2025-11372 | LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-62424 | ClipBucket path traversal vulnerability in template editor allows arbitrary file read and write | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-107803 | ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10128 | Eulerpool Research Systems <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-10130 | Layers <= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-10189 | BP Direct Menus <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11361 | Essential Blocks <= 5.7.1 - Authenticated (Author+) Server-Side Request Forgery | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-96648 | Data Tables Generator by Supsystic <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'd | 346755 |
| CVE-2026-97396 | Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'd | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2016-8581 | AlienVault OSSIM SQL Injection and Remote Code Execution | 331028 , 340145 , 340155 , 340156 , 340157 , 340159 , 341145 , 341155 , 341245 , 360147 , 360148 , 380026 |
| CVE-2017-7896 | Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution | 344364 , 390716 , 393655 |
| CVE-2025-11018 | Four-Faith Water Conservancy Informatization Platform download.do;usrlogout.do.do path traversal | 344360 , 347009 , 390709 |
| CVE-2025-11032 | kidaze CourseSelectionSystem COUNT3s6.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11036 | code-projects E-Commerce Website admin_account_update.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11039 | Campcodes Computer Sales and Inventory System us_edit1.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11040 | code-projects Hostel Management System index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11046 | Tencent WeKnora test testEmbeddingModel server-side request forgery | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-11052 | kidaze CourseSelectionSystem COUNT3s5.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11053 | PHPGurukul Small CRM forgot-password.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 , 390572 |
| CVE-2025-11055 | SourceCodester Online Hotel Reservation System updateaddress.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11057 | SourceCodester Pet Grooming Management Software print_inv.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11062 | Campcodes Online Learning Management System save_student.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11063 | Campcodes Online Learning Management System edit_department.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11064 | Campcodes Online Learning Management System teachers.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11066 | code-projects Online Bidding System bidlist.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11070 | Projectworlds Online Shopping System cart_add.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11074 | code-projects Project Monitoring System login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11075 | Campcodes Online Learning Management System de_activate.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11076 | Campcodes Online Learning Management System edit_teacher.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11077 | Campcodes Online Learning Management System add_content.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11089 | kidaze CourseSelectionSystem COUNT3s4.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11101 | itsourcecode Open Source Job Portal index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11102 | Campcodes Online Learning Management System edit_content.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11105 | code-projects Simple Scheduling System addsubject.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11106 | code-projects Simple Scheduling System addfaculty.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11107 | code-projects Simple Scheduling System addcourse.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11108 | code-projects Simple Scheduling System addroom.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11110 | Campcodes Online Learning Management System school_year.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11111 | Campcodes Advanced Online Voting Management System candidates_edit.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11115 | code-projects Simple Scheduling System addtime.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11118 | CodeAstro Student Grading System adminLogin.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11309 | Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findDeptPage.do doFilter sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11311 | Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findTenantPage.do findTenantPage sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11312 | Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findModulePage.do findModulePage sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11313 | Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findRolePage.do findRolePage sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11314 | Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findSingConfigPage.do findRolePage sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11315 | Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findUserPage.do findUserPage sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11316 | Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findCategoryPage.do findCategoryPage sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11317 | Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findSingConfigPage.do findRolePage sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11318 | Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 uploadWxFile.do unrestricted upload | 351000 |
| CVE-2025-11329 | code-projects Online Course Registration manage-students.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11334 | Campcodes Online Apartment Visitor Management System visitor-detail.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11336 | Four-Faith Water Conservancy Informatization Platform download.do;otherlogout.do path traversal | 344360 , 347009 , 390709 |
| CVE-2025-11337 | Four-Faith Water Conservancy Informatization Platform download.do;othersusrlogout.do path traversal | 344360 , 347009 , 390709 |
| CVE-2025-11343 | code-projects Student Crud Operation delete.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11348 | Campcodes Online Apartment Visitor Management System index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11349 | Campcodes Online Apartment Visitor Management System search-visitor.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11350 | Campcodes Online Apartment Visitor Management System bwdates-reports-details.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-103482 | Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage | 333140 , 340095 , 340147 , 341256 , 342259 , 346755 |
| CVE-2026-104083 | SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-107844 | Contao: Path traversal in the images controller | 340007 , 344360 , 347009 , 390709 |
| CVE-2011-2757 | ManageEngine ServiceDesk Plus Path Traversal | 340007 , 344365 |
| CVE-2013-3336 | ColdFusion 'password.properties' Hash Extraction | 340007 , 344360 , 347009 , 390709 |
| CVE-2014-100002 | ManageEngine Support Center Plus Directory Traversal | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-9703 | Ultimate Addons for Elementor Lite < 2.5.0 - Author+ Stored XSS | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11034 | Dibo Data Decision Making System common_dep.action.jsp downloadImpTemplet path traversal | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-11035 | Jinher OA text xml external entity reference | 330791 , 340152 , 344360 , 344370 , 344372 , 344373 , 347009 , 380018 |
| CVE-2025-11054 | itsourcecode Open Source Job Portal index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11056 | ProjectsAndPrograms School Management System select-students.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11078 | itsourcecode Open Source Job Portal controller.php unrestricted upload | 351000 |
| CVE-2025-11088 | itsourcecode Open Source Job Portal index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11090 | itsourcecode Open Source Job Portal index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11104 | CodeAstro Electricity Billing System bill.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11112 | PHPGurukul Employee Record Management System myprofile.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11113 | CodeAstro Online Leave Application signup.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11114 | CodeAstro Online Leave Application leaveAplicationForm.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11119 | itsourcecode Hostel Management System POST Request index.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11139 | Bjskzy Zhiyou ERP com.artery.form.services.FormStudioUpdater uploadStudioFile path traversal | 340007 , 344360 , 390709 |
| CVE-2025-11306 | qianfox FoxCMS Search cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11320 | zhuimengshaonian wisdom-education UploadController.java uploadFile unrestricted upload | 351000 |
| CVE-2025-11330 | PHPGurukul Beauty Parlour Management System sales-reports-detail.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11351 | code-projects Online Hotel Reservation System editpicexec.php unrestricted upload | 351000 |
| CVE-2025-11352 | code-projects Online Hotel Reservation System addexec.php unrestricted upload | 351000 |
| CVE-2025-11902 | yanyutao0402 ChanCMS findField sql injection | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-11903 | yanyutao0402 ChanCMS update sql injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-11904 | yanyutao0402 ChanCMS hasUse sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11905 | yanyutao0402 ChanCMS gather.js getArticle code injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-62655 | SQL injection in Cargo via Special:CargoExport | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11073 | Keyfactor RG-EW5100BE HTTP POST Request cmd command injection | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-11103 | Projectworlds Online Tours and Travels change-image.php unrestricted upload | 351000 |
| CVE-2025-11124 | code-projects Project Monitoring System postjob.php cross site scripting | 333140 , 333141 , 340147 , 341256 , 342259 , 346755 |
| CVE-2025-11136 | YiFang CMS Backend File.php webUploader unrestricted upload | 351000 |
| CVE-2025-11141 | Ruijie NBR2100G-E branch_passw.php listAction os command injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-11308 | Vanderlande Baggage 360 messages cross site scripting | 333140 , 333141 , 340147 , 340148 , 341256 , 346755 |
| CVE-2025-11342 | code-projects Online Course Registration edit-course.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11851 | Apeman ID71 set_alias.cgi cross site scripting | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-7871 | Portabilis i-Diario conteudos cross site scripting | 333140 , 333141 , 340087 , 340099 , 340147 , 341099 , 341266 |
| CVE-2025-7872 | Portabilis i-Diario justificativas-de-falta cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11027 | givanz Vvveb SVG File cross site scripting | 333141 , 340087 , 340095 , 340099 , 340247 , 340248 , 341099 , 341266 , 342259 , 346755 , 350148 |
| CVE-2025-11068 | westboy CicadasCMS save cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11289 | westboy CicadasCMS Template Management TemplateFileServiceImpl.java save cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |