Atomicorp WAF Research Notes
Research Update - 2026-10-17
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2026-18516 | Improper Encoding or Escaping of Output in Crafty Controller | 340099 , 341099 |
| CVE-2026-111663 | Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-102608 | ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php) | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-44977 | countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-30971 | ZoneMinder: Authenticated RCE via command injection in monitor Device Path | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-111685 | IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynum | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-111686 | IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-42269 | countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-111622 | smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-92263 | SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/resto | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-111669 | ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-111700 | WebVella ERP through 1.8.8 SQL Injection via EQL Query API | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-111718 | AipexBase through commit 690adb9 SQL Injection via /api/data/invoke | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-111662 | Chaskiq through 2.0.3 Unauthenticated SSRF via /oembed Endpoint | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-111720 | fish-island-backend through commit 7c61b78 SSRF via /api/web/parse | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-109983 | YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-104246 | Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments | 340007 , 344360 , 390709 |
| CVE-2026-102923 | SparkyFitness: SSRF via unvalidated custom_url in AI service settings | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-111635 | Helical Insight through 7.0.0 Path Traversal via /getExternalResource | 340007 , 344360 , 347009 , 390709 |