Atomicorp WAF Research Notes

Research Update - 2026-10-16

Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.

The entries published in this update represent research notes produced during ongoing analysis activities.

These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.

Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.

Presence means a positive research finding was published. Absence means no conclusion should be drawn.

CVE Notes Published in This Update

CVEVulnerability NameRules Observed
CVE-2026-57155OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2015-7450IBM WebSphere RCE Java Deserialization Vulnerability398110
CVE-2017-18365Github Enterprise Default Session Secret And Deserialization Vulnerability398110
CVE-2025-12673Flex QR Code Generator <= 1.2.7 - Unauthenticated Arbitrary File Upload351000
CVE-2025-50229jizhicms SQL Injection Vulnerability340156
CVE-2026-104798My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'a340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655
CVE-2026-57496NetLicensing MCP Server: REST Path Traversal Bypasses Token Redaction340007 , 344360 , 347009 , 390709
CVE-2025-61318emlog Path Traversal Vulnerability344360 , 347009
CVE-2026-47168EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722
CVE-2026-62679Lychee: Path traversal in SecurePathController allows authenticated arbitrary file read340007 , 344360 , 347009 , 390709
CVE-2020-11853Micro Focus Operations Bridge Manager Authenticated Remote Code Execution398110
CVE-2026-55872GYM One admin user list is vulnerable to stored cross-site scripting333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148
CVE-2026-111214Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2026-111217Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2026-111218Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2026-111234SimplePie through 1.9.0 Local File Read via file:// Redirect340007 , 344360 , 390709
CVE-2026-58390OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-53574EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2009-1122MS09-020 IIS6 WebDAV Unicode Authentication Bypass398110
CVE-2009-1535MS09-020 IIS6 WebDAV Unicode Authentication Bypass398110
CVE-2026-111221Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2026-107764SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector hre333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-109193HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value340087 , 340099 , 341099 , 341266 , 346755
CVE-2026-111313JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch337109 , 337110 , 344360 , 398021 , 398022
CVE-2026-111230Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL340007 , 344360 , 390709
CVE-2026-111320ValueCell through 0.1.20 Unauthenticated SSRF via /api/v1/models/check337109 , 337110 , 344360 , 398021 , 398022
CVE-2025-13922Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection v340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122
CVE-2026-55871GYM One: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in admin/users/index.php340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2026-78851Grav CMS 2.0.3 through 2.0.6 Path Traversal Vulnerability340007 , 344360 , 347009 , 390709
CVE-2026-93767Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter340007 , 344360 , 347009 , 390709
CVE-2026-100106FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 346755
CVE-2026-111171Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022
CVE-2026-111385Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools390719
CVE-2020-12704UliCMS 2020.1 - Persistent Cross-Site Scripting399705
CVE-2024-34321ProPhoenix Law RMS v2022.2403.3.101 Cross-Site Scripting Vulnerability333140 , 333141 , 340099 , 340147 , 341099 , 341266 , 342259
CVE-2025-63238limesurvey Cross-Site Scripting Vulnerability333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2025-70797limesurvey Arbitrary Code Execution Vulnerability333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-57568Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2025-14245IdeaCMS Coupon.php whereRaw sql injection340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2026-106707XXL-JOB <=3.5.0-SNAPSHOT Cross-Site Scripting Vulnerability333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-55840Scoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypass344365
CVE-2026-58391OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2026-58392OPNsense: Stored XSS in Services: NTP GPS333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2025-27218Sitecore CVE-2025-27218 BinaryFormatter Deserialization Exploit398110
CVE-2026-111321TaskingAI through 0.3.0 SSRF via OpenAPI servers[0].url in Actions337109 , 337110 , 344360 , 398021 , 398022
CVE-2026-55414NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-suppli337109 , 337110 , 344360 , 398021 , 398022
CVE-2026-58394OPNsense: Stored XSS in Administration Settings via Certificate Description333140 , 333141 , 342259
CVE-2025-34266Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via plugin-config/addins/menus333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-111168LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter333140 , 333141 , 334168 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-78850Matomo v.5.11.2 Information Disclosure Vulnerability337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022
CVE-2026-111232Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755
CVE-2025-61074mitarbeiter portal Cross-Site Scripting Vulnerability333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-55875Helium: SSRF via External Calendar URL Allows Authenticated Users to Probe Internal Network337109 , 337110 , 344360 , 398021 , 398022
CVE-2025-14244GreenCMS Menu Management CustomController.class.php cross site scripting340095