On this page
Atomicorp WAF Rule 334168
Rule Summary
- Rule ID: 334168
- Status: Active
- Alert message: Atomicorp.com WAF Rules: Request content type header contains invalid characters
- Observed CWEs: CWE-19 (1), CWE-20 (10), CWE-22 (7), CWE-23 (1), CWE-73 (2), CWE-74 (1), CWE-77 (2), CWE-78 (13), CWE-79 (7), CWE-89 (15), CWE-91 (1), CWE-94 (9), CWE-119 (2), CWE-178 (1), CWE-200 (2), CWE-255 (6), CWE-264 (6), CWE-269 (1), CWE-284 (2), CWE-287 (6), CWE-306 (11), CWE-326 (1), CWE-345 (1), CWE-352 (1), CWE-425 (1), CWE-434 (60), CWE-494 (1), CWE-502 (2), CWE-532 (1), CWE-552 (1), CWE-611 (2), CWE-668 (1), CWE-755 (1), CWE-798 (3), CWE-862 (3), CWE-863 (1), CWE-913 (1), CWE-915 (1), CWE-918 (7)
- Revision: 8
- Rule severity: Critical (2)
- Phase: 2 (request body)
- Request surfaces: Request headers
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Request content type header contains invalid characters” in the request headers. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-1999-1011 | MS99-025 Microsoft IIS MDAC msadcs.dll RDS Arbitrary Remote Command Execution | data access components | 10.0 (v2.0) | High |
| CVE-2009-3843 | Apache Tomcat Manager Authenticated Upload Code Execution | operations manager | 10.0 (v2.0) | High |
| CVE-2009-4188 | Apache Tomcat Manager Authenticated Upload Code Execution | operations dashboard | 10.0 (v2.0) | High |
| CVE-2009-4189 | Apache Tomcat Manager Authenticated Upload Code Execution | operations manager | 10.0 (v2.0) | High |
| CVE-2010-0219 | Axis2 / SAP BusinessObjects Authenticated Code Execution (via SOAP) | axis2 | 10.0 (v2.0) | High |
| CVE-2011-0276 | HP OpenView Performance Insight Server Backdoor Account Code Execution | openview performance insight | 10.0 (v2.0) | High |
| CVE-2012-10026 | WordPress Asset-Manager PHP File Upload Vulnerability | asset-manager | 10.0 (v4.0) | Critical |
| CVE-2012-3260 | HP SiteScope Remote Code Execution | sitescope | 10.0 (v2.0) | High |
| CVE-2012-3261 | HP SiteScope Remote Code Execution | sitescope | 10.0 (v2.0) | High |
| CVE-2012-5201 | HP Intelligent Management Center Arbitrary File Upload | intelligent management center | 10.0 (v2.0) | High |
| CVE-2013-10066 | Kordil EDMS v2.2.60rc3 Unauthenticated Arbitrary File Upload Vulnerability | EDMS | 10.0 (v4.0) | Critical |
| CVE-2014-125123 | Kloxo SQL Injection and Remote Code Execution | Kloxo | 10.0 (v4.0) | Critical |
| CVE-2015-2284 | Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability | firewall security manager | 10.0 (v2.0) | High |
| CVE-2015-5371 | SolarWinds Storage Manager Authentication Bypass | storage manager | 10.0 (v2.0) | High |
| CVE-2021-22205 | GitLab Unauthenticated Remote ExifTool Command Injection | gitlab | 10.0 (v3.1) | Critical |
| CVE-2013-0803 | PolarBear CMS PHP File Upload Vulnerability | polarbear cms | 9.8 (v3.1) | Critical |
| CVE-2013-1359 | SonicWALL GMS 6 Arbitrary File Upload | analyzer | 9.8 (v3.1) | Critical |
| CVE-2014-8516 | Visual Mining NetCharts Server Remote Code Execution | netcharts server | 9.8 (v3.1) | Critical |
| CVE-2014-8739 | Wordpress Creative Contact Form Upload Vulnerability | creative contact form | 9.8 (v3.1) | Critical |
| CVE-2015-10135 | WordPress WPshop eCommerce Arbitrary File Upload Vulnerability | wpshop 2 | 9.8 (v3.1) | Critical |
| CVE-2015-10143 | WordPress Platform Theme File Upload Vulnerability | platform theme | 9.8 (v3.1) | Critical |
| CVE-2015-9266 | Ubiquiti airOS Arbitrary File Upload | airmax ac firmware | 9.8 (v3.0) | Critical |
| CVE-2016-1209 | WordPress Ninja Forms Unauthenticated File Upload | ninja forms | 9.8 (v3.0) | Critical |
| CVE-2016-2555 | ATutor 2.2.1 SQL Injection / Remote Code Execution | atutor | 9.8 (v3.0) | Critical |
| CVE-2017-11317 | Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization | ui for asp.net ajax | 9.8 (v3.1) | Critical |
| CVE-2017-17560 | Western Digital MyCloud multi_uploadify File Upload Vulnerability | my cloud pr4100 firmware | 9.8 (v3.0) | Critical |
| CVE-2017-5638 | S2-045 Remote Code Execution Vulnerablity（CVE-2017-5638） | struts | 9.8 (v3.1) | Critical |
| CVE-2017-9101 | PlaySMS import.php Authenticated CSV File Upload Code Execution | playsms | 9.8 (v3.0) | Critical |
| CVE-2018-15961 | Adobe ColdFusion CKEditor unrestricted file upload | coldfusion | 9.8 (v3.1) | Critical |
| CVE-2018-5999 | AsusWRT LAN Unauthenticated Remote Code Execution | asuswrt | 9.8 (v3.0) | Critical |
| CVE-2018-6000 | AsusWRT LAN Unauthenticated Remote Code Execution | asuswrt | 9.8 (v3.0) | Critical |
| CVE-2018-7665 | ClipBucket beats_uploader Unauthenticated Arbitrary File Upload | clipbucket | 9.8 (v3.0) | Critical |
| CVE-2018-8733 | Nagios XI Chained Remote Code Execution | nagios xi | 9.8 (v3.0) | Critical |
| CVE-2018-8734 | Nagios XI Chained Remote Code Execution | nagios xi | 9.8 (v3.0) | Critical |
| CVE-2018-9206 | blueimp's jQuery (Arbitrary) File Upload | jquery file upload | 9.8 (v3.1) | Critical |
| CVE-2019-11580 | Atlassian Crowd pdkinstall Unauthenticated Plugin Upload RCE | crowd | 9.8 (v3.1) | Critical |
| CVE-2019-1619 | Cisco Data Center Network Manager Unauthenticated Remote Code Execution | data center network manager | 9.8 (v3.1) | Critical |
| CVE-2019-1620 | Cisco Data Center Network Manager Unauthenticated Remote Code Execution | data center network manager | 9.8 (v3.1) | Critical |
| CVE-2019-18935 | Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization | ui for asp.net ajax | 9.8 (v3.1) | Critical |
| CVE-2020-28871 | Monitorr unauthenticated Remote Code Execution (RCE) | monitorr | 9.8 (v3.1) | Critical |
| CVE-2020-36849 | WordPress AIT CSV Import Export Unauthenticated Remote Code Execution | csv import / export | 9.8 (v3.1) | Critical |
| CVE-2020-4427 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.8 (v3.1) | Critical |
| CVE-2020-4429 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.8 (v3.1) | Critical |
| CVE-2021-1472 | Cisco Small Business RV Series Authentication Bypass and Command Injection | rv160 firmware | 9.8 (v3.1) | Critical |
| CVE-2021-1473 | Cisco Small Business RV Series Authentication Bypass and Command Injection | rv340 firmware | 9.8 (v3.1) | Critical |
| CVE-2021-21978 | VMware View Planner Unauthenticated Log File Upload RCE | view planner | 9.8 (v3.1) | Critical |
| CVE-2021-44077 | ManageEngine ServiceDesk Plus CVE-2021-44077 | manageengine servicedesk plus | 9.8 (v3.1) | Critical |
| CVE-2022-21587 | Oracle E-Business Suite (EBS) Unauthenticated Arbitrary File Upload | e-business suite | 9.8 (v3.1) | Critical |
| CVE-2022-29464 | WSO2 Arbitrary File Upload to RCE | api manager | 9.8 (v3.1) | Critical |
| CVE-2022-39952 | Fortinet FortiNAC keyUpload.jsp arbitrary file write | fortinac | 9.8 (v3.1) | Critical |
| CVE-2022-40471 | Clinic's Patient Management System 1.0 - Unauthenticated RCE | clinic's patient management system | 9.8 (v3.1) | Critical |
| CVE-2022-45297 | EQ Enterprise management system v2.2.0 - SQL Injection | eq | 9.8 (v3.1) | Critical |
| CVE-2023-22515 | Atlassian Confluence Unauthenticated Remote Code Execution | confluence data center | 9.8 (v3.1) | Critical |
| CVE-2023-22518 | Atlassian Confluence Unauth JSON setup-restore Improper Authorization leading to RCE (CVE-2023-22518) | confluence data center | 9.8 (v3.1) | Critical |
| CVE-2023-34362 | MOVEit SQL Injection vulnerability | moveit cloud | 9.8 (v3.1) | Critical |
| CVE-2023-38096 | NETGEAR ProSafe Network Management System 300 Arbitrary File Upload | prosafe network management system | 9.8 (v3.1) | Critical |
| CVE-2023-40504 | LG Simple Editor Command Injection (CVE-2023-40504) | simple editor | 9.8 (v3.1) | Critical |
| CVE-2023-43177 | CrushFTP Unauthenticated RCE | crushftp | 9.8 (v3.1) | Critical |
| CVE-2024-0204 | Fortra GoAnywhere MFT Unauthenticated Remote Code Execution | goanywhere managed file transfer | 9.8 (v3.1) | Critical |
| CVE-2024-11680 | ProjectSend r1295 - r1605 Unauthenticated Remote Code Execution | projectsend | 9.8 (v3.1) | Critical |
| CVE-2024-24578 | RaspberryMatic unauthenticated Remote Code Execution vulnerability through HMServer File Upload. | raspberrymatic | 9.8 (v3.1) | Critical |
| CVE-2024-3116 | pgAdmin Binary Path API RCE | pgadmin 4 | 9.8 (v3.1) | Critical |
| CVE-2024-3408 | D-Tale RCE | d-tale | 9.8 (v3.1) | Critical |
| CVE-2024-43917 | WordPress TI WooCommerce Wishlist SQL Injection (CVE-2024-43917) | ti woocommerce wishlist | 9.8 (v3.1) | Critical |
| CVE-2024-48760 | GestioIP 3.5.7 Remote Command Execution | gestioip | 9.8 (v3.1) | Critical |
| CVE-2024-8517 | SPIP BigUp Plugin Unauthenticated RCE | spip | 9.8 (v3.1) | Critical |
| CVE-2024-8856 | WordPress WP Time Capsule Arbitrary File Upload to RCE | backup and staging by wp time capsule | 9.8 (v3.1) | Critical |
| CVE-2026-3891 | WordPress Unauthenticated RCE via Pix for WooCommerce plugin | Pix for WooCommerce | 9.8 (v3.1) | Critical |
| CVE-2013-10067 | Glossword v1.8.8 - 1.8.12 Arbitrary File Upload Vulnerability | Glossword | 9.4 (v4.0) | Critical |
| CVE-2026-19681 | Tenable Security Center SCAP Audit File Command Injection | security center | 9.4 (v4.0) | Critical |
| CVE-2009-3068 | Adobe RoboHelp Server 8 Arbitrary File Upload and Execute | robohelp server | 9.3 (v2.0) | High |
| CVE-2012-10036 | Project Pier Arbitrary File Upload Vulnerability | ProjectPier | 9.3 (v4.0) | Critical |
| CVE-2012-10038 | Auxilium RateMyPet Arbitrary File Upload Vulnerability | RateMyPet | 9.3 (v4.0) | Critical |
| CVE-2012-10045 | XODA 0.4.5 Arbitrary PHP File Upload Vulnerability | XODA | 9.3 (v4.0) | Critical |
| CVE-2012-10049 | WebPageTest Arbitrary PHP File Upload | WebPageTest | 9.3 (v4.0) | Critical |
| CVE-2012-10050 | CuteFlow v2.11.2 Arbitrary File Upload Vulnerability | CuteFlow | 9.3 (v4.0) | Critical |
| CVE-2012-10052 | EGallery PHP File Upload Vulnerability | EGallery | 9.3 (v4.0) | Critical |
| CVE-2013-10034 | Kaseya uploadImage Arbitrary File Upload | KServer | 9.3 (v4.0) | Critical |
| CVE-2013-10038 | FlashChat Arbitrary File Upload | FlashChat | 9.3 (v4.0) | Critical |
| CVE-2013-10054 | LibrettoCMS File Manager Arbitary File Upload Vulnerability | LibrettoCMS | 9.3 (v4.0) | Critical |
| CVE-2013-10055 | Havalite CMS Arbitary File Upload Vulnerability | Havalite CMS | 9.3 (v4.0) | Critical |
| CVE-2025-3096 | Clinic's Patient Management System 1.0 - Unauthenticated RCE | Clinic's Patient Management System | 9.3 (v4.0) | Critical |
| CVE-2025-34125 | D-Link Cookie Command Execution | DSP-W110A1 | 9.3 (v4.0) | Critical |
| CVE-2025-71336 | Flowise - Unsandboxed Remote Code Execution via Custom MCP | flowise | 9.3 (v4.0) | Critical |
| CVE-2026-32985 | Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Template Import | xerte online toolkits | 9.3 (v4.0) | Critical |
| CVE-2014-125126 | Simple E-Document Arbitrary File Upload | Simple E-Document | 9.2 (v4.0) | Critical |
| CVE-2020-4428 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.1 (v3.1) | Critical |
| CVE-2025-54236 | Magento SessionReaper | commerce | 9.1 (v3.1) | Critical |
| CVE-2015-2049 | D-Link DCS-931L File Upload | dcs-931l firmware | 9.0 (v2.0) | High |
| CVE-2026-40487 | Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS | postiz | 9.0 (v3.1) | Critical |
| CVE-2026-62378 | RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover | console | 9.0 (v3.1) | Critical |
| CVE-2026-48989 | Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS | Windows-MCP | 8.9 (v4.0) | High |
| CVE-2013-3591 | vTigerCRM v5.4.0/v5.3.0 Authenticated Remote Code Execution | vtiger crm | 8.8 (v3.1) | High |
| CVE-2013-3629 | ISPConfig Authenticated Arbitrary PHP Code Execution | ispconfig | 8.8 (v3.1) | High |
| CVE-2014-9312 | WordPress Photo Gallery Unrestricted File Upload | photo gallery | 8.8 (v3.0) | High |
| CVE-2015-10144 | WordPress Responsive Thumbnail Slider Arbitrary File Upload | thumbnail carousel slider | 8.8 (v3.1) | High |
| CVE-2015-3884 | qdPM v7 Arbitrary PHP File Upload Vulnerability | qdpm | 8.8 (v3.1) | High |
| CVE-2015-6000 | Vtiger CRM - Authenticated Logo Upload RCE | vtiger crm | 8.8 (v3.1) | High |
| CVE-2017-16524 | Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload | web viewer | 8.8 (v3.0) | High |
| CVE-2017-16666 | Xplico Remote Code Execution | xplico | 8.8 (v3.0) | High |
| CVE-2017-6090 | phpCollab 2.5.1 Unauthenticated File Upload | phpcollab | 8.8 (v3.0) | High |
| CVE-2017-9080 | PlaySMS sendfromfile.php Authenticated "Filename" Field Code Execution | playsms | 8.8 (v3.0) | High |
| CVE-2018-7357 | ZTE ZXHN H168N - Improper Access Restrictions | zxhn h168n firmware | 8.8 (v3.0) | High |
| CVE-2018-7358 | ZTE ZXHN H168N - Improper Access Restrictions | zxhn h168n firmware | 8.8 (v3.0) | High |
| CVE-2018-8735 | Nagios XI Chained Remote Code Execution | nagios xi | 8.8 (v3.0) | High |
| CVE-2018-8736 | Nagios XI Chained Remote Code Execution | nagios xi | 8.8 (v3.0) | High |
| CVE-2019-15949 | Nagios XI Prior to 5.6.6 getprofile.sh Authenticated Remote Command Execution | nagios xi | 8.8 (v3.1) | High |
| CVE-2020-27387 | HorizontCMS Arbitrary PHP File Upload | horizontcms | 8.8 (v3.1) | High |
| CVE-2021-24347 | Wordpress Plugin SP Project and Document - Authenticated Remote Code Execution | sp project & document manager | 8.8 (v3.1) | High |
| CVE-2021-43258 | ChurchInfo 1.2.13-1.3.0 Authenticated RCE | churchinfo | 8.8 (v3.1) | High |
| CVE-2022-2297 | Clinic's Patient Management System 1.0 - Unauthenticated RCE | clinic's patient management system | 8.8 (v3.1) | High |
| CVE-2022-44384 | rConfig Vendors Auth File Upload RCE | rconfig | 8.8 (v3.1) | High |
| CVE-2023-22952 | SugarCRM unauthenticated Remote Code Execution (RCE) | sugarcrm | 8.8 (v3.1) | High |
| CVE-2023-36969 | CmsMadeSimple Authenticated File Manager RCE | cms made simple | 8.8 (v3.1) | High |
| CVE-2023-38098 | NETGEAR ProSafe Network Management System 300 Arbitrary File Upload | prosafe network management system | 8.8 (v3.1) | High |
| CVE-2023-46214 | Splunk Authenticated XSLT Upload RCE | cloud | 8.8 (v3.1) | High |
| CVE-2024-21683 | Atlassian Confluence Administrator Code Macro Remote Code Execution | confluence data center | 8.8 (v3.1) | High |
| CVE-2024-48594 | Prison Management System 1.0 Authenticated RCE via Unrestricted File Upload | prison management system | 8.8 (v3.1) | High |
| CVE-2025-34511 | Sitecore XP CVE-2025-34511 Post-Authentication File Upload | experience commerce | 8.8 (v3.1) | High |
| CVE-2025-49113 | Roundcube Post-Auth RCE via PHP Object Deserialization | webmail | 8.8 (v3.1) | High |
| CVE-2012-10042 | Sflog! CMS 1.0 Arbitrary File Upload Vulnerability | Sflog! CMS | 8.7 (v4.0) | High |
| CVE-2012-10056 | PHP Volunteer Management System v1.0.2 Arbitrary File Upload Vulnerability | PHP Volunteer Management | 8.7 (v4.0) | High |
| CVE-2013-10032 | GetSimpleCMS PHP File Upload Vulnerability | getsimplecms | 8.7 (v4.0) | High |
| CVE-2015-8279 | Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload | web viewer | 8.6 (v3.0) | High |
| CVE-2016-1525 | NETGEAR ProSafe Network Management System 300 Arbitrary File Upload | prosafe network management software 300 | 8.6 (v3.0) | High |
| CVE-2025-34097 | ProcessMaker Plugin Upload | ProcessMaker | 8.6 (v4.0) | High |
| CVE-2026-112371 | H3C Magic NX15 RPC esps write code injection | Magic NX15 | 8.6 (v4.0) | High |
| CVE-2026-92985 | SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels | siyuan | 8.6 (v4.0) | High |
| CVE-2023-47218 | QNAP QTS and QuTS Hero Unauthenticated Remote Code Execution in quick.cgi | qts | 8.3 (v3.1) | High |
| CVE-2026-54549 | Meta Ads MCP: Server-Side Request Forgery (SSRF) in upload_ad_image via Unrestricted image_url Fetch | meta-ads-mcp | 8.3 (v3.1) | High |
| CVE-2021-25094 | Tatsu Wordpress Plugin RCE | tatsu | 8.1 (v3.1) | High |
| CVE-2025-50286 | Grav CMS Admin Direct Install Authenticated Plugin Upload RCE | grav | 8.1 (v3.1) | High |
| CVE-2019-9624 | Webmin Upload Authenticated RCE | webmin | 7.8 (v3.0) | High |
| CVE-2021-22204 | GitLab Unauthenticated Remote ExifTool Command Injection | exiftool | 7.8 (v3.1) | High |
| CVE-2005-2733 | Simple PHP Blog Remote Command Execution | simple php blog | 7.5 (v2.0) | High |
| CVE-2008-5191 | SePortal SQLi Remote Code Execution | seportal | 7.5 (v2.0) | High |
| CVE-2008-6508 | Openfire Admin Console Authentication Bypass | openfire | 7.5 (v2.0) | High |
| CVE-2009-3548 | Apache Tomcat Manager Authenticated Upload Code Execution | tomcat | 7.5 (v2.0) | High |
| CVE-2010-0557 | Apache Tomcat Manager Authenticated Upload Code Execution | cognos express | 7.5 (v2.0) | High |
| CVE-2013-3520 | VMware vCenter Chargeback Manager ImageUploadServlet Arbitrary File Upload | vcenter chargeback manager | 7.5 (v2.0) | High |
| CVE-2013-5014 | Symantec Endpoint Protection Manager /servlet/ConsoleServlet Remote Command Execution | endpoint protection manager | 7.5 (v2.0) | High |
| CVE-2014-10021 | WordPress WP Symposium 14.11 Shell Upload | wp symposium | 7.5 (v2.0) | High |
| CVE-2014-3704 | Drupal < 7.32 "Drupalgeddon" SQL Injection (CVE-2014-3704) | drupal | 7.5 (v2.0) | High |
| CVE-2014-6037 | ManageEngine Eventlog Analyzer Arbitrary File Upload | manageengine eventlog analyzer | 7.5 (v2.0) | High |
| CVE-2014-7146 | MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability | mantisbt | 7.5 (v2.0) | High |
| CVE-2014-9567 | ProjectSend Arbitrary File Upload | projectsend | 7.5 (v2.0) | High |
| CVE-2015-1172 | WordPress Holding Pattern Theme Arbitrary File Upload | holding pattern | 7.5 (v2.0) | High |
| CVE-2015-1400 | NPDS CMS REvolution-13 - SQL Injection | revolution | 7.5 (v2.0) | High |
| CVE-2015-1587 | Maarch LetterBox Unrestricted File Upload | gec/ged | 7.5 (v2.0) | High |
| CVE-2016-0752 | Ruby on Rails Dynamic Render File Upload Remote Code Execution | rails | 7.5 (v3.1) | High |
| CVE-2018-2392 | SAP Internet Graphics Server (IGS) XMLCHART XXE | internet graphics server | 7.5 (v3.0) | High |
| CVE-2018-2393 | SAP Internet Graphics Server (IGS) XMLCHART XXE | internet graphics server | 7.5 (v3.0) | High |
| CVE-2021-21975 | VMware vRealize Operations (vROps) Manager SSRF RCE | cloud foundation | 7.5 (v3.1) | High |
| CVE-2026-12592 | SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header | SlimStat Analytics | 7.5 (v3.1) | High |
| CVE-2016-1713 | Vtiger CRM - Authenticated Logo Upload RCE | vtiger crm | 7.3 (v3.0) | High |
| CVE-2018-1000094 | CMS Made Simple Authenticated RCE via File Upload/Copy | cms made simple | 7.2 (v3.0) | High |
| CVE-2018-19422 | Intelliants Subrion CMS 4.2.1 - Authenticated File Upload Bypass to RCE | subrion cms | 7.2 (v3.1) | High |
| CVE-2020-25042 | MaraCMS Arbitrary PHP File Upload | maracms | 7.2 (v3.1) | High |
| CVE-2020-35578 | Nagios XI Prior to 5.8.0 - Plugins Filename Authenticated Remote Code Exection | nagios xi | 7.2 (v3.1) | High |
| CVE-2021-24145 | Wordpress Plugin Modern Events Calendar - Authenticated Remote Code Execution | modern events calendar lite | 7.2 (v3.1) | High |
| CVE-2021-24155 | Wordpress Plugin Backup Guard - Authenticated Remote Code Execution | backup guard | 7.2 (v3.1) | High |
| CVE-2021-39352 | Wordpress Plugin Catch Themes Demo Import RCE | catch themes demo import | 7.2 (v3.1) | High |
| CVE-2023-28128 | Ivanti Avalanche FileStoreConfig File Upload | avalanche | 7.2 (v3.1) | High |
| CVE-2024-25641 | Cacti Import Packages RCE | cacti | 7.2 (v3.1) | High |
| CVE-2025-68109 | ChurchCRM Database Restore RCE 6.2.0 | churchcrm | 7.2 (v3.1) | High |
| CVE-2012-0938 | TestLink v1.9.3 Arbitrary File Upload Vulnerability | testlink | 6.5 (v2.0) | Medium |
| CVE-2013-3522 | vBulletin index.php/ajax/api/reputation/vote nodeid Parameter SQL Injection | vbulletin | 6.5 (v2.0) | Medium |
| CVE-2013-5015 | Symantec Endpoint Protection Manager /servlet/ConsoleServlet Remote Command Execution | endpoint protection manager | 6.5 (v2.0) | Medium |
| CVE-2014-4977 | Dell SonicWALL Scrutinizer 11.01 methodDetail SQL Injection | scrutinizer | 6.5 (v2.0) | Medium |
| CVE-2014-5460 | Wordpress SlideShow Gallery Authenticated File Upload | tibulant slideshow gallery | 6.5 (v2.0) | Medium |
| CVE-2018-18760 | RhinOS CMS 3.x - Arbitrary File Download | rhinos | 6.5 (v3.0) | Medium |
| CVE-2021-21983 | VMware vRealize Operations (vROps) Manager SSRF RCE | cloud foundation | 6.5 (v3.1) | Medium |
| CVE-2024-57487 | Car Rental System 1.0 File Upload RCE (Authenticated) | online car rental system | 6.5 (v3.1) | Medium |
| CVE-2014-8598 | MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability | mantisbt | 6.4 (v2.0) | Medium |
| CVE-2023-6568 | Mlflow - Cross-Site Scripting | mlflow | 6.1 (v3.1) | Medium |
| CVE-2009-4098 | OpenX banner-edit.php File Upload PHP Code Execution | openx | 6.0 (v2.0) | Medium |
| CVE-2011-3833 | Support Incident Tracker Remote Command Execution | support incident tracker | 6.0 (v2.0) | Medium |
| CVE-2014-1610 | MediaWiki Thumb.php Remote Command Execution | mediawiki | 6.0 (v2.0) | Medium |
| CVE-2026-31951 | LibreChat's MCP Server Header Injection Enables OAuth Token Theft | librechat | 5.7 (v3.1) | Medium |
| CVE-2026-7223 | BigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgery | HyperChat | 5.5 (v4.0) | Medium |
| CVE-2019-1622 | Cisco Data Center Network Manager Unauthenticated Remote Code Execution | data center network manager | 5.3 (v3.1) | Medium |
| CVE-2021-1499 | Cisco HyperFlex HX Data Platform unauthenticated file upload to RCE (CVE-2021-1499) | hyperflex hx data platform | 5.3 (v3.1) | Medium |
| CVE-2026-85650 | Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel | trigger.dev | 5.3 (v4.0) | Medium |
| CVE-2026-111168 | LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter | libredesk | 5.1 (v4.0) | Medium |
| CVE-2010-4094 | Apache Tomcat Manager Authenticated Upload Code Execution | rational quality manager | 5.0 (v2.0) | Medium |
| CVE-2024-31839 | Chaos RAT XSS to RCE | chaos | 4.8 (v3.1) | Medium |
| CVE-2011-3829 | Support Incident Tracker Remote Command Execution | support incident tracker | 4.0 (v2.0) | Medium |
| CVE-2026-15624 | nextlevelbuilder GoClaw invoke Endpoint create_video_byteplus.go bytePlusDownloadVideo server-side request forgery | GoClaw | 2.1 (v4.0) | Low |
| CVE-2026-16124 | nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery | GoClaw | 2.1 (v4.0) | Low |
| CVE-2026-10583 | nextlevelbuilder GoClaw TTS Configuration Endpoint tts_config.go import server-side request forgery | GoClaw | 2.0 (v4.0) | Low |
| CVE-2024-30850 | Chaos RAT XSS to RCE | - | N/A | N/A |
| CVE-2025-0655 | D-Tale RCE | - | N/A | N/A |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.