Atomicorp WAF Research Notes
Research Update - 2026-10-25
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2026-46512 | Frogman: Dialplan template parameters interpolated into extensions_custom.conf without escaping | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2022-44276 | responsive filemanager Security Vulnerability | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390501 , 393655 |
| CVE-2023-25207 | dpd france SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-51821 | Shenzhou Shihan Video Conference System v.1.0 Arbitrary Code Execution Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-47428 | Vitest browser mode serves unsanitized otelCarrier query parameter as inline script | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-61876 | LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-12257 | Remote code execution in Mura Software’s CMS | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-58409 | ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-62378 | RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover | 334168 , 340099 , 341099 |
| CVE-2023-2288 | Otter - Gutenberg Blocks < 2.2.6 - Author+ PHAR Deserialization | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 |
| CVE-2026-35152 | Apache Fineract: SQL injection in runreports endpoint | 340017 , 340145 , 340156 , 341145 , 341245 , 380026 , 380122 , 390572 |
| CVE-2026-62312 | 9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments | 344360 , 344361 , 344363 , 344364 , 344366 , 393655 |
| CVE-2026-116009 | Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-55629 | Whistle: Path traversal | 340007 , 344360 , 390709 |
| CVE-2026-57855 | Cockpit CMS Missing Authorization in Bucket File Storage API | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-22100 | Comnand injection in OCPP ReserveLogin message | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9585 | Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-61430 | PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-55173 | AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-56287 | Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-57821 | Apache Fineract: Office list: SQL Injection via Subquery in orderBy | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-62242 | Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-63088 | stoatchat < 0.14.0 SSRF via DNS-based IP Blocklist Bypass | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-35036 | Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2023-29095 | WordPress RSVPMarker Plugin < 10.5.5 is vulnerable to SQL Injection | 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-40522 | FrontAccounting < 2.4.20 SQL Injection via rep601.php | 340017 , 340145 , 340156 , 341145 , 341245 , 380026 , 380122 , 390572 |
| CVE-2026-9587 | Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-9588 | Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal | 333140 |
| CVE-2026-60091 | PraisonAI before 4.6.78 Unauthenticated SSRF via webhook_url | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-63086 | text-generation-inference 3.3.7 SSRF via fetch_image in multimodal chat completions | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-63096 | Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-56678 | 9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-31013 | ad phonebook Cross-Site Scripting Vulnerability | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-44767 | Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-50182 | AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 390585 |
| CVE-2026-34981 | whisperX REST API: SSRF in download_from_url() — URL validation happens after HTTP request, extension bypass via .mp3 | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-47160 | Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-116000 | Zylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgery | 340007 , 344360 , 390709 |
| CVE-2026-116048 | krupalshah EmployeeRecruitmentSystem Registration registerform1.php mysql_query sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-116049 | krupalshah EmployeeRecruitmentSystem Registration Wizard registerform2.php mysql_query sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-116050 | krupalshah Employee Recruitment System Registration registerform3.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15517 | Jinher OA PlanGiveOut.aspx sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15597 | SourceCodester Class and Exam Timetabling System edit_exam2.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15675 | code-projects Online Job Portal EditUser.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15676 | code-projects Online Job Portal DeleteUser.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15703 | SourceCodester Simple and Nice Shopping Cart Script userproductdeletequery.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-16016 | poco-ai poco-claw task.py run_task server-side request forgery | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-5669 | Cyber-III Student-Management-System Parameter login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-35046 | Tandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level) | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-11944 | openSIS Classic 9.3 - Authenticated path traversal in SentMail attachment download | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-15502 | AojiaoZero Antaris PayPal IPN Payment ipn.php _rewardPurchase sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34951 | Reflected XSS in footer.php in Workbench Allows Attackers to Hijack Authenticated Sessions | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 |
| CVE-2026-61504 | Rejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listing | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-52840 | Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal netwo | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-52838 | Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-115982 | phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-116045 | 1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-116047 | Privoce Vocechat Query Parameter widget.html cross site scripting | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-15500 | AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-15501 | AstrBotDevs AstrBot MCP Test Endpoint tools.py ToolsRoute.test_mcp_connection server-side request forgery | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-15512 | pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-15523 | CodeAstro Simple Online Leave Management System dashboard.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15558 | CodeAstro Simple Online Leave Management System deletemp.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15559 | CodeAstro Simple Online Leave Management System POST accept.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15595 | SourceCodester Class and Exam Timetabling System forsubject.php cross site scripting | 333140 , 333141 , 340087 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 |
| CVE-2026-15596 | SourceCodester Class and Exam Timetabling System subject.php cross site scripting | 333140 , 333141 , 340087 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 |
| CVE-2026-15619 | mosaxiv clawlet IPv4 tool_web_fetch.go web_fetch server-side request forgery | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-15620 | mosaxiv clawlet tool_web_fetch.go tools.webFetch server-side request forgery | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-15624 | nextlevelbuilder GoClaw invoke Endpoint create_video_byteplus.go bytePlusDownloadVideo server-side request forgery | 334168 , 390719 |
| CVE-2026-15626 | nextlevelbuilder GoClaw ACP ToolBridge Workspace tool_bridge.go writeFile path traversal | 340007 , 344360 , 390709 |
| CVE-2026-15628 | zhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision._download_to_data_url server-side request forgery | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-15672 | itsourcecode Electronic Judging System add_judges.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15715 | SourceCodester Class and Exam Timetabling System exam.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-15750 | mastergo-design mastergo-magic-mcp mcp__getComponentLink get-component-link.ts z.string server-side request forgery | 390719 |
| CVE-2026-15921 | nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory | 347009 |
| CVE-2026-16009 | itsourcecode Hospital Management System prescriptionorderdetail.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15518 | AREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted upload | 351000 |
| CVE-2026-15678 | code-projects Online Job Portal DetailJob.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-115981 | phpIPAM index.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |