Atomicorp WAF Research Notes
Research Update - 2026-10-28
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2024-57521 | ruoyi Arbitrary Code Execution Vulnerability | 340145 , 380122 |
| CVE-2026-18051 | W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write | 340006 |
| CVE-2024-25182 | vvvebjs Security Vulnerability | 351000 , 390501 |
| CVE-2024-44065 | cloudlog SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-116692 | MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller- | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-102788 | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2024-25181 | vvvebjs Server-Side Request Forgery Vulnerability | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-58256 | GRR vulnerable to Remote Code Execution Via PHP Code Injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2014-125138 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via | 351000 |
| CVE-2024-58294 | FreePBX 16 Authenticated Remote Code Execution via API Module | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 |
| CVE-2024-58309 | xbtitFM 4.1.18 Unauthenticated SQL Injection in shoutedit.php | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 380122 , 390572 |
| CVE-2024-58312 | xbtitFM 4.1.18 Unauthenticated Path Traversal in nfogen.php | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-112350 | Sunhillo SureLine Path Traversal via radarUpdater.cgi | 344360 , 347009 , 390709 |
| CVE-2026-112351 | Sunhillo SureLine OS Command Injection via networkDiag.cgi | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2013-20007 | Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-114083 | Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints | 344360 , 347009 , 390709 |
| CVE-2026-117493 | Multiple vulnerabilities in Sisense’s Cloud BI Platform | 333140 , 333141 , 342259 |
| CVE-2026-117494 | Multiple vulnerabilities in Sisense’s Cloud BI Platform | 333140 , 333141 , 342259 |
| CVE-2026-58205 | GRR has a Reflected XSS issue | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-25183 | vvvebjs Path Traversal Vulnerability | 340007 , 344360 , 390709 |
| CVE-2026-116690 | MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-15323 | Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*] | 340007 , 344360 , 390709 |
| CVE-2026-109999 | AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter | 333140 , 333141 , 340095 , 340147 , 340148 , 346755 |
| CVE-2026-110662 | MxChat <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating | 346755 |
| CVE-2014-125137 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via adm | 344360 , 347009 |
| CVE-2026-117565 | Artalk before 2.10.1 Unauthenticated SSRF via Comment Page Title Fetch | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2024-39037 | mynet SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2024-42718 | croogo Path Traversal Vulnerability | 344360 , 347009 |
| CVE-2024-44632 | student record system SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2024-44639 | student record system SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2024-44648 | small crm SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2024-44653 | ecommerce website SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2024-44662 | online shopping portal SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2024-55016 | student record system SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-60319 | perfreeblog Server-Side Request Forgery Vulnerability | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-109209 | All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta vi | 333140 , 340095 , 342259 |
| CVE-2026-109370 | Document Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' | 340087 , 340099 , 341099 , 341266 |
| CVE-2026-116680 | Homebox generic notifier SSRF via HTTP redirect after URL validation | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2024-35322 | mynet Cross-Site Scripting Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2024-44635 | student record system Cross-Site Scripting Vulnerability | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2024-44647 | small crm Cross-Site Scripting Vulnerability | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-46336 | school management system Cross-Site Scripting Vulnerability | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-60934 | HR Performance Solutions Performance Pro v3.19.17 Cross-Site Scripting Vulnerability | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-63448 | water management system Cross-Site Scripting Vulnerability | 340087 , 340095 , 340099 , 341099 , 341266 , 346755 |
| CVE-2025-65136 | Cross-Site Scripting | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-118376 | WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390709 , 390722 , 398021 , 398022 |
| CVE-2026-117512 | oretnom23 php-travel-agency-system employee_insert.php unrestricted upload | 351000 |
| CVE-2026-117513 | oretnom23 php-travel-agency-system Admin Search Pages customer_search.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-117516 | oretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-50363 | maid hiring management system Cross-Site Scripting Vulnerability | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-57244 | openkm Cross-Site Scripting Vulnerability | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 |
| CVE-2026-116874 | SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-116875 | SemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator Parameters | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-116885 | Semantic MediaWiki before 7.3.1 Reflected XSS via Special:SMWAdmin id Parameter | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-116886 | Semantic MediaWiki before 7.3.1 Stored XSS via External Identifier in Special:Browse | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-116887 | Semantic MediaWiki 3.0.0 before 7.3.1 Stored XSS via Special:Browse Keyword Property | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-116889 | SemanticMediaWiki 2.5.0 before 7.3.1 Stored XSS via Special:Browse Code Property | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-116892 | SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-116891 | SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-117535 | REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool | 333140 , 333141 , 340087 , 340095 , 340099 , 341099 , 341266 , 346755 |
| CVE-2013-20009 | Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-116883 | Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions | 333140 , 333141 |
| CVE-2026-116888 | SemanticMediaWiki 3.2.0 before 7.3.1 Stored XSS via Special:Browse Group Heading | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-35321 | mynet Cross-Site Scripting Vulnerability | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2024-7083 | Email Encoder < 2.3.4 - Admin+ Stored XSS | 346755 |
| CVE-2026-117509 | crownpku Rasa_NLU_Chi Model Persistor persistor.py Persistor._decompress path traversal | 340007 , 344360 , 390709 |