Atomicorp WAF Research Notes
Research Update - 2026-10-19
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2025-64709 | Typebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook Block | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-13595 | CIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File Upload | 351000 |
| CVE-2025-13597 | AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload | 351000 |
| CVE-2025-66401 | MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-9697 | Ajax WooSearch <= 1.0.0 - Unauthenticated SQL Injection | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2025-10364 | Unauthenticated Arbitrary Command Injection in Evertz SDVN | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2025-10870 | SQL injection in DIAL's CentrosNet | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-66571 | UNA CMS 9.0.0-RC1 - 14.0.0-RC4 PHP Object Injection | 340014 , 340023 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390614 |
| CVE-2025-12977 | fluent bit Path Traversal Vulnerability | 340007 , 344360 , 390709 |
| CVE-2025-11724 | EM Beer Manager <= 3.2.3 - Authenticated (Subscriber+) Arbitrary File Upload | 351000 |
| CVE-2025-65103 | OpenSTAManager has an authenticated SQL Injection vulnerability in API via 'display' parameter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13695 | SQL Injection in the Integratec Application | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-34331 | AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated File Read via download.php | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-34334 | AudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via TestFax.php & LPE | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-34350 | UnForm Server < 10.1.15 Doc Flow Unauthenticated File Read | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-62722 | LinkAce: Stored XSS Vulnerability in Link Title Field Through Social Media Sharing Feature | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12061 | Tax Service Electronic HDM < 1.2.1 - Unauthenticated Arbitrary SQL Execution | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2025-9587 | CTL Behance Importer Lite <= 1.0 - Unauthenticated SQL Injection | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2025-34332 | AudioCodes Fax/IVR Appliance <= 2.6.23 Insecure Service Control Scripts LPE | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2025-34333 | AudioCodes Fax/IVR Appliance <= 2.6.23 World-Writable Webroot LPE | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-112051 | Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration | 340007 , 344360 , 390709 |
| CVE-2025-13000 | DB Access <= 0.8.7 - Subscriber+ SQLi | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2025-11704 | Elegance Menu <= 1.9 - Authenticated (Contributor+) Local File Inclusion | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-11994 | Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2025-65958 | Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/we | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-112017 | JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13380 | AI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read | 340748 , 344360 , 347006 , 347009 , 390709 |
| CVE-2025-49138 | HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter | 340007 , 344360 , 390709 |
| CVE-2025-12666 | Google Drive upload and download link <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting | 333140 , 333141 , 340095 , 342259 |
| CVE-2025-12123 | Customer Reviews Collector for WooCommerce <= 4.6.1 - Reflected Cross-Site Scripting | 333140 , 333141 , 340087 , 340099 , 340147 , 341099 , 341256 , 341266 , 346755 |
| CVE-2025-63737 | rockoa Cross-Site Scripting Vulnerability | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-65019 | Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-66026 | REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types] | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11427 | WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-12604 | itsourcecode Online Loan Management System load_fields.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12605 | itsourcecode Online Loan Management System manage_loan.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12606 | itsourcecode Online Loan Management System manage_borrower.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12607 | itsourcecode Online Loan Management System manage_payment.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12608 | itsourcecode Online Loan Management System manage_user.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13233 | itsourcecode Inventory Management System index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13235 | itsourcecode Inventory Management System login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13237 | itsourcecode Inventory Management System LogSignModal.PHP sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13240 | code-projects Student Information System searchquery.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13241 | code-projects Student Information System index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13242 | code-projects Student Information System register.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13248 | SourceCodester Patients Waiting Area Queue Management System api_patient_schedule.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13410 | Campcodes Retro Basketball Shoes Online Store receipt.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13420 | itsourcecode Human Resource Management System EventStore.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13421 | itsourcecode Human Resource Management System NoticeStore.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13422 | freeprojectscodes Sports Club Management System change_s_pwd.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13449 | code-projects Online Shop Project login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13451 | SourceCodester Online Shop Project action.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13554 | Campcodes Supplier Management System Login index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13555 | Campcodes School File Management System Login index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13556 | Campcodes Online Polling System checklogin.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13557 | Campcodes Online Polling System registeracc.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13560 | SourceCodester Company Website CMS reset-password.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380122 , 390572 |
| CVE-2025-9596 | itsourcecode Sports Management System login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 344366 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9597 | itsourcecode Apartment Management System rented_all_info.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9598 | itsourcecode Apartment Management System year_setup.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9599 | itsourcecode Apartment Management System month_setup.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9600 | itsourcecode Apartment Management System member_type_setup.php sql injection | 340017 , 341245 , 380122 |
| CVE-2025-9601 | itsourcecode Apartment Management System employee_salary_setup.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9610 | code-projects Online Event Judging System create_account.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9643 | itsourcecode Apartment Management System utility_bill_setup.php sql injection | 340017 , 341245 , 380122 |
| CVE-2025-9644 | itsourcecode Apartment Management System bill_setup.php sql injection | 340017 , 341245 , 380122 |
| CVE-2025-9660 | SourceCodester Bakeshop Online Ordering System passwordrecover.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9669 | Jinher OA GetTreeDate.aspx sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9678 | Campcodes Online Loan Management System ajax.php sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2025-9679 | itsourcecode Student Information System course_edit1.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9691 | Campcodes Online Shopping System login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9692 | Campcodes Online Shopping System product.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9699 | SourceCodester Online Polling System Code checklogin.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9700 | SourceCodester Online Book Store publisher_list.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9701 | SourceCodester Simple Cafe Billing System receipt.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9702 | SourceCodester Simple Cafe Billing System sales_report.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9704 | SourceCodester Water Billing System viewbill.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9705 | SourceCodester Water Billing System paybill.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9706 | SourceCodester Water Billing System edit.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9729 | PHPGurukul Online Course Registration student-registration.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9730 | itsourcecode Apartment Management System updateProfile.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9733 | code-projects Human Resource Integrated System login_timeee.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9739 | Campcodes Online Water Billing System process.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9740 | code-projects Human Resource Integrated System log_query.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9741 | code-projects Human Resource Integrated System login_query12.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9742 | code-projects Human Resource Integrated System login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9743 | code-projects Human Resource Integrated System login_attendance2.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9749 | HKritesh009 Grocery List Management Web App update.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9750 | Campcodes Online Learning Management System login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9757 | Campcodes/SourceCodester Courier Management System ajax.php login sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2025-9759 | Campcodes/SourceCodester Courier Management System ajax.php signup sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2025-9788 | SourceCodester/Campcodes School Log Management System admin_class.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-112027 | light0011 cms Uploadify check-exists.php file_exists file information disclosure | 344360 , 390709 |
| CVE-2025-59788 | nextcloud server Cross-Site Scripting Vulnerability | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-34398 | MailEnable < 10.54 Reflected XSS in AddressesBcc Parameter of AddressBook.aspx | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-9728 | givanz Vvveb login.tpl cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-13415 | icret EasyImages SVG Image upload.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-34258 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicemap/plan | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-34259 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicemap/building | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-34260 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via action/schedule | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-34261 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicegroups/ | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-34262 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devices/name/{agent_id} | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-34263 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via plugin-config/dashboards/menus | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-34264 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via dog/{agentId} | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-34265 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via rule-engines | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-40700 | Reflected Cross-Site Scripting (XSS) in Governalia by IDI Eikon | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 , 350147 , 350148 |
| CVE-2025-40702 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-40703 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-40704 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-40705 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-40706 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-40707 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-40708 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-41079 | Multiple vulnerabilities in Seafile | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-41080 | Multiple vulnerabilities in Seafile | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-41101 | Multiple vulnerabilities in Fairsketch's RISE CRM Framework | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-41104 | Multiple vulnerabilities in Fairsketch's RISE CRM Framework | 333140 , 340095 , 340147 , 341256 , 342259 , 346755 |
| CVE-2025-41105 | Multiple vulnerabilities in Fairsketch's RISE CRM Framework | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-41106 | Multiple vulnerabilities in Fairsketch's RISE CRM Framework | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-41349 | Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este | 333140 , 333141 , 342259 |
| CVE-2025-41350 | Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este | 333140 , 333141 , 342259 |
| CVE-2025-43804 | digital experience platform Cross-Site Scripting Vulnerability | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 , 350147 , 350148 |
| CVE-2026-112097 | SourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-43817 | digital experience platform Cross-Site Scripting Vulnerability | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62248 | digital experience platform Cross-Site Scripting Vulnerability | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2025-62263 | digital experience platform Cross-Site Scripting Vulnerability | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-65229 | lyrion music server Cross-Site Scripting Vulnerability | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-63739 | rockoa Improper Access Control Vulnerability | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-63740 | rockoa SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13001 | Donation <= 1.0 - Admin+ SQLi | 340017 , 340144 , 340156 , 340157 , 380122 |
| CVE-2026-112076 | alexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forge | 337109 , 337110 , 344360 , 390719 , 398021 , 398022 |
| CVE-2025-62719 | LinkAce: Limited Server-Side Request Forgery (SSRF) in Keyword Fetching Functionality | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-12626 | jeecgboot jeewx-boot WxActGoldeneggsPrizesController.java getImgUrl path traversal | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-13057 | Campcodes School Fees Payment Management System ajax.php sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2025-13059 | SourceCodester Alumni Management System manage_career.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13061 | itsourcecode Online Voting System index.php unrestricted upload | 351000 |
| CVE-2025-13123 | AMTT Hotel Broadband Operation System get_firstdate.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13234 | itsourcecode Inventory Management System index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13236 | itsourcecode Inventory Management System index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13238 | Bdtask Flight Booking Software Edit Profile edit unrestricted upload | 351000 |
| CVE-2025-13243 | code-projects Student Information System editprofile.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13244 | code-projects Student Information System register.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 380106 |
| CVE-2025-13246 | shsuishang ShopSuite ModulithShop JwtAuthenticationFilter.java JwtAuthenticationFilter path traversal | 344360 |
| CVE-2025-13251 | WeiYe-Jing datax-web sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13325 | itsourcecode Student Information System enrollment_edit1.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13346 | SourceCodester Train Station Ticketing System ajax.php sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2025-13347 | SourceCodester Train Station Ticketing System ajax.php sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2025-13396 | code-projects Courier Management System add-office.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13949 | ProudMuBai GoFilm FileController.go SingleUpload unrestricted upload | 351000 |
| CVE-2025-9595 | code-projects Student Information Management System login.php cross site scripting | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9607 | Portabilis i-Educar Tabelas de Arredondamento view sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9608 | Portabilis i-Educar Formula de Cálculo de Média view sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9647 | mtons mblog list cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 |
| CVE-2025-9651 | shafhasan chatbox chat.php sql injection | 340013 , 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 340181 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9656 | PHPGurukul Directory Management System add-directory.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-9684 | Portabilis i-Educar Formula de Cálculo de Média edit sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9685 | Portabilis i-Educar Listagem de áreas de conhecimento view sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9686 | Portabilis i-Educar Listagem de áreas de conhecimento edit sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9689 | SourceCodester Advanced School Management System item_select sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-9690 | SourceCodester Advanced School Management System vendordetails sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-111984 | AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-111986 | AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-111992 | itsmeravitejak Online-Examination-System Exam exam.php startExam sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-112034 | aircheng-org iWebShop-5 Login Redirect _userInfo.php redirect | 344365 |
| CVE-2026-112078 | RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-112087 | itsourcecode Online Cake Ordering System confirm.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-112088 | Dav-ee dairy-management-system add.php mysqli_query sql injection | 340016 , 340145 , 380026 , 380122 , 390572 |
| CVE-2026-112090 | Dav-ee dairy-management-system pay.php mysqli_real_escape_string sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-112093 | subhajitkhan online-clinic-management-system feedback.php cross site scripting | 333140 , 333141 , 340147 , 340148 , 346755 |
| CVE-2025-12593 | code-projects Simple Online Hotel Reservation System Photo edit_room.php unrestricted upload | 351000 |
| CVE-2025-12594 | code-projects Simple Online Hotel Reservation System add_account.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12597 | SourceCodester Best House Rental Management System admin_class.php save_category sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2025-12598 | SourceCodester Best House Rental Management System admin_class.php save_tenant sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2025-12609 | CodeAstro Gym Management System update-progress.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12610 | CodeAstro Gym Management System view-progress-report.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12614 | SourceCodester Best House Rental Management System admin_class.php delete_payment sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2025-13075 | code-projects Responsive Hotel Site usersettingdel.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13076 | code-projects Responsive Hotel Site usersetting.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13178 | Bdtask/CodeCanyon SalesERP User Profile edit_profile cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-13180 | Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System edit_profile cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-13185 | Bdtask/CodeCanyon News365 profile unrestricted upload | 351000 |
| CVE-2025-13245 | code-projects Student Information System editprofile.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-13343 | SourceCodester Interview Management System editQuestion.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-13424 | Campcodes Supplier Management System add_product.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13450 | SourceCodester Online Shop Project register.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-9652 | Portabilis i-Educar Cadastrar tipo de transferência educar_transferencia_tipo_cad.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-9653 | Portabilis i-Educar Cadastrar projeto educar_projeto_cad.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-9721 | Portabilis i-Educar edit cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-9722 | Portabilis i-Educar educar_tipo_ocorrencia_disciplinar_cad.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-9723 | Portabilis i-Educar educar_tipo_regime_cad.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-9738 | Portabilis i-Educar educar_tipo_ensino_cad.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-112032 | aircheng-org iWebShop-5 util.php search sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-112042 | diem-project diem dmWidget dmBaseLinkTag.php text cross site scripting | 333140 , 333141 |
| CVE-2026-112095 | SourceCodester Inventory System Product Management products_handler.php save cross site scripting | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-112096 | SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12920 | qianfox FoxCMS Product.php edit cross site scripting | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-13186 | Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution manage_customer cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-13412 | Campcodes Retro Basketball Shoes Online Store admin_running.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-112039 | diem-project diem Administrative Console actions.class.php append cross site scripting | 340087 , 340095 , 340099 , 341099 , 341266 , 346755 |