Atomicorp WAF Research Notes
Research Update - 2026-10-13
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2025-59735 | Multiple vulnerabilities in AndSoft's e-TMS | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-59736 | Multiple vulnerabilities in AndSoft's e-TMS | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-59737 | Multiple vulnerabilities in AndSoft's e-TMS | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-59738 | Multiple vulnerabilities in AndSoft's e-TMS | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-59739 | Multiple vulnerabilities in AndSoft's e-TMS | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-59740 | Multiple vulnerabilities in AndSoft's e-TMS | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-59742 | Multiple vulnerabilities in AndSoft's e-TMS | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-59743 | Multiple vulnerabilities in AndSoft's e-TMS | 340013 , 340016 , 340017 , 340144 , 340181 , 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2025-71429 | GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-109238 | Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder | 337109 , 337110 , 341245 , 344360 , 398021 , 398022 |
| CVE-2026-109573 | phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-57143 | PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url paramete | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-84317 | Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the o | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-84318 | Nginx UI: MCP nginx_config_add Bypasses Directive Validation — Authenticated RCE | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-109308 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-108894 | Linksys E1700 Static Route addStaticRoute os command injection | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-109108 | Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-109286 | Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-109397 | Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-104078 | Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344365 , 344366 , 344370 , 393655 |
| CVE-2026-75888 | Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-12609 | Eclipse Theia - Unauthenticated Path Traversal | 347009 |
| CVE-2026-102562 | AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter | 333140 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-109169 | LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-59746 | Multiple vulnerabilities in AndSoft's e-TMS | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-59747 | Multiple vulnerabilities in AndSoft's e-TMS | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-59748 | Multiple vulnerabilities in AndSoft's e-TMS | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-59749 | Multiple vulnerabilities in AndSoft's e-TMS | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-59755 | Multiple vulnerabilities in AndSoft's e-TMS | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-109239 | Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch | 337109 , 337110 , 340163 , 398021 , 398022 |
| CVE-2026-109309 | SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-61583 | TS3 Manager is vulnerable to unauthenticated reflected XSS attack due to insecure error handling | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-104140 | QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-103061 | Path traversal in Gleam via unvalidated package application names | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-108900 | Exponent CMS XML-RPC xmlrpc.php userLogin sql injection | 340017 , 340145 , 340156 , 341145 , 341245 , 380026 , 380122 , 390572 |
| CVE-2026-108956 | code-projects Online Reviewer System User Update btn_functions.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-108964 | SourceCodester Performance Indicator System addproduct.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-108965 | SourceCodester Performance Indicator System edit_quantity.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-108966 | SourceCodester Performance Indicator System product.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-108967 | SourceCodester Performance Indicator System edit_credit.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-108968 | SourceCodester Performance Indicator System sales_history.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-108970 | itsmeravitejak Online-Examination-System Registration Form database.php addNewUser sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2024-58391 | Frappe before 15.4.0 XSS via Printview Parameters | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-109328 | Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-109352 | LibreNMS before 26.9.0 Stored XSS via wireless sensor description | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-109354 | LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-109355 | LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2025-40989 | Stored XSS in Creativeitem Ekushey CRM | 333140 , 333141 , 340147 , 340148 , 346755 |
| CVE-2025-40991 | Stored XSS in Creativeitem Ekushey CRM | 333140 , 333141 |
| CVE-2025-40992 | Stored XSS in Creativeitem Sociopro | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-59750 | Multiple vulnerabilities in AndSoft's e-TMS | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-59751 | Multiple vulnerabilities in AndSoft's e-TMS | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-59752 | Multiple vulnerabilities in AndSoft's e-TMS | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-59753 | Multiple vulnerabilities in AndSoft's e-TMS | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-59754 | Multiple vulnerabilities in AndSoft's e-TMS | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-59756 | Multiple vulnerabilities in AndSoft's e-TMS | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-59758 | Multiple vulnerabilities in AndSoft's e-TMS | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-59767 | Multiple vulnerabilities in AndSoft's e-TMS | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-59769 | Multiple vulnerabilities in AndSoft's e-TMS | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-108942 | philz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scripting | 333140 , 333141 |
| CVE-2026-109300 | Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-109327 | Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-54292 | Client-Side Path Traversal in LXD-UI | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-108821 | Tencent WeKnora SQL Validator inject.go validateSubquery sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 347009 , 360147 , 360148 , 380026 , 380122 , 390572 , 390709 |
| CVE-2026-108824 | DataEase Utils.java Utils.buildCalcField sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-108926 | itsourcecode Baptism Information Management System ebaptism.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-108927 | itsourcecode Baptism Information Management System pbaptism.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-108928 | itsourcecode Online Admission System sum.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-108931 | Netcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scripting | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-108932 | Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-108959 | itsourcecode Online Cake Ordering System addtransacdetail.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-108829 | Zen Cart Module Configuration modules.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-108908 | Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-108827 | Zen Cart Administrative Module Management general.php zen_call_function code injection | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |