On this page
Atomicorp WAF Rule 351000
Rule Summary
- Rule ID: 351000
- Status: Active
- Alert message: Atomicorp.com Upload Malware Scanner: Malicious File upload attempt detected and blocked
- Observed CWEs: CWE-20 (1), CWE-22 (6), CWE-73 (1), CWE-74 (1), CWE-79 (2), CWE-94 (2), CWE-284 (95), CWE-287 (1), CWE-306 (5), CWE-352 (1), CWE-434 (161), CWE-502 (1), CWE-862 (1)
- Revision: 2
- Rule severity: Critical (2)
- Phase: 2 (request body)
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Atomicorp.com Upload Malware Scanner: Malicious File upload attempt detected and blocked”. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2000-1024 | ewave servletexec Security Vulnerability | ewave servletexec | 10.0 (v2.0) | High |
| CVE-2024-13981 | LiveBos UploadFile.do Arbitrary File Upload | LiveBOS | 10.0 (v4.0) | Critical |
| CVE-2025-34163 | Dongsheng Logistics Software Unauthenticated Arbitrary File Upload | Dongsheng Logistics Software | 10.0 (v4.0) | Critical |
| CVE-2026-57827 | Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 | rsfiles! | 10.0 (v4.0) | Critical |
| CVE-2015-10138 | Work The Flow File Upload <= 2.5.2 - Arbitrary File Upload | work the flow file upload | 9.8 (v3.1) | Critical |
| CVE-2023-27168 | write-back manager Arbitrary Code Execution Vulnerability | write-back manager | 9.8 (v3.1) | Critical |
| CVE-2024-13342 | Booster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload | booster for woocommerce | 9.8 (v3.1) | Critical |
| CVE-2025-12673 | Flex QR Code Generator <= 1.2.7 - Unauthenticated Arbitrary File Upload | Flex QR Code Generator | 9.8 (v3.1) | Critical |
| CVE-2025-13595 | CIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File Upload | CIBELES AI | 9.8 (v3.1) | Critical |
| CVE-2025-13597 | AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload | AI Feeds | 9.8 (v3.1) | Critical |
| CVE-2025-9314 | Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload | The Developer Tools WordPress plugin through 1.1.3 | 9.8 (v3.1) | Critical |
| CVE-2026-110002 | Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter | Snazzy Social Media Feed | 9.8 (v3.1) | Critical |
| CVE-2026-18080 | ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM | ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce | 9.8 (v3.1) | Critical |
| CVE-2026-2942 | ProSolution WP Client <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess | ProSolution WP Client | 9.8 (v3.1) | Critical |
| CVE-2026-3535 | DSGVO Google Web Fonts GDPR <= 1.1 - Unauthenticated Arbitrary File Upload via 'fonturl' Parameter | DSGVO Google Web Fonts GDPR | 9.8 (v3.1) | Critical |
| CVE-2026-36669 | ck_upload_handler.php in Feng Office 3.11.13.11 Arbitrary File Upload Vulnerability | ck upload handler.php in Feng Office 3.11.13.11 | 9.8 (v3.1) | Critical |
| CVE-2026-4885 | Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload | Piotnet Addons For Elementor Pro | 9.8 (v3.1) | Critical |
| CVE-2026-49827 | WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434) | WebErpMesv2 | 9.8 (v3.1) | Critical |
| CVE-2026-50894 | easyadmin v2.0.2.2 Arbitrary Code Execution Vulnerability | - | 9.8 (v3.1) | Critical |
| CVE-2026-67678 | RainyGao-Hithub DocSys v.2.02.80 Arbitrary Code Execution Vulnerability | RainyGao-Hithub DocSys v.2.02.80 | 9.8 (v3.1) | Critical |
| CVE-2026-71805 | Path Traversal | - | 9.8 (v3.1) | Critical |
| CVE-2026-75327 | In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java Arbitrary File Upload Vulnerability | In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java | 9.8 (v3.1) | Critical |
| CVE-2026-85097 | Bricksforge WordPress Plugin <=3.1.8.9 - Unauthenticated Arbitrary File Upload | Bricksforge | 9.8 (v3.1) | Critical |
| CVE-2026-8778 | MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload | MIPL Grouped Checkout Fields for WooCommerce. Customize & Organize Checkout Fields. | 9.8 (v3.1) | Critical |
| CVE-2016-20052 | Snews CMS 1.7 Unrestricted File Upload via snews_files | snews | 9.3 (v4.0) | Critical |
| CVE-2018-25412 | Delta Sql 1.8.2 Arbitrary File Upload via docs_upload.php | deltasql | 9.3 (v4.0) | Critical |
| CVE-2019-25471 | FileThingie 2.5.7 Arbitrary File Upload via ft2.php | file thingie | 9.3 (v4.0) | Critical |
| CVE-2021-47940 | WordPress Download From Files 1.48 Arbitrary File Upload | Download From Files | 9.3 (v4.0) | Critical |
| CVE-2022-4995 | Weaver E-cology 9.0 File Upload RCE via uploaderOperate.jsp | E-cology 9.0 | 9.3 (v4.0) | Critical |
| CVE-2023-54405 | H3C CVM Unauthenticated File Upload via fileUpload/upload Token | CVM | 9.3 (v4.0) | Critical |
| CVE-2024-14037 | Redsea Cloud eHR Unauthenticated File Upload RCE via PtFjk.mob | Red Sea Cloud eHR | 9.3 (v4.0) | Critical |
| CVE-2026-70558 | Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token | Dinky | 9.3 (v4.0) | Critical |
| CVE-2026-49849 | xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution | xshop | 9.1 (v3.1) | Critical |
| CVE-2025-11724 | EM Beer Manager <= 3.2.3 - Authenticated (Subscriber+) Arbitrary File Upload | EM Beer Manager | 8.8 (v3.1) | High |
| CVE-2025-70151 | scholars tracking system Arbitrary Code Execution Vulnerability | scholars tracking system | 8.8 (v3.1) | High |
| CVE-2025-9216 | StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authent | StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More | 8.8 (v3.1) | High |
| CVE-2025-9561 | AP Background 3.8.1 - 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload via advParallax | AP Background | 8.8 (v3.1) | High |
| CVE-2026-15965 | MaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter | MaxUpload – Big File Uploads – Increase Maximum File Upload Size | 8.8 (v3.1) | High |
| CVE-2026-18438 | Templately <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Im | Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! | 8.8 (v3.1) | High |
| CVE-2026-32931 | Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCE | chamilo lms | 8.8 (v3.1) | High |
| CVE-2026-41269 | Flowise: File Upload Validation Bypass in createAttachment | flowise | 8.8 (v3.1) | High |
| CVE-2026-60009 | theia Arbitrary Code Execution Vulnerability | theia | 8.8 (v3.1) | High |
| CVE-2026-6147 | LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload | LightSync Pro – Connect & Sync Cloud Assets | Lightroom, Canva, Figma, Dropbox & Shutterstock | 8.8 (v3.1) | High |
| CVE-2026-72557 | Cockpit CMS Cockpit CMS - Unrestricted File Upload | Cockpit CMS | 8.8 (v3.1) | High |
| CVE-2018-25409 | SIM-PKH 2.4.1 Arbitrary File Upload via aksi_pengurus.php | SIM-PKH | 8.7 (v4.0) | High |
| CVE-2019-25673 | UniSharp Laravel File Manager v2.0.0-alpha7 Arbitrary File Upload | Laravel File Manager | 8.7 (v4.0) | High |
| CVE-2026-103474 | yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE | yii2-starter-kit | 8.7 (v4.0) | High |
| CVE-2026-55676 | Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component | Malcolm | 8.7 (v4.0) | High |
| CVE-2026-94104 | NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager | nivocart | 8.7 (v4.0) | High |
| CVE-2025-61678 | FreePBX firmware file upload | endpointman | 8.6 (v4.0) | High |
| CVE-2026-104471 | YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import | yeswiki | 8.6 (v4.0) | High |
| CVE-2026-26212 | Rara One Click Demo Import < 1.3.5 Arbitrary File Upload RCE | Rara One Click Demo Import | 8.6 (v4.0) | High |
| CVE-2026-63429 | HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context | heyform | 8.6 (v3.1) | High |
| CVE-2026-82524 | UnoPim File Upload RCE via TinyMCE Image Upload Endpoint | unopim | 8.6 (v4.0) | High |
| CVE-2026-115481 | baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbi | basercms | 8.5 (v4.0) | High |
| CVE-2026-5695 | Multiple vulnerabilities in the Microweber administration panel | Administration panel | 8.4 (v4.0) | High |
| CVE-2026-10818 | WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering | WPForms Pro | 8.1 (v3.1) | High |
| CVE-2026-108101 | HortusFox through 6.3 Unrestricted File Upload via Plant Attachments | hortusfox-web | 7.7 (v4.0) | High |
| CVE-2026-82988 | vCast Improper Authentication Vulnerability | vCast | 7.5 (v3.1) | High |
| CVE-2026-116236 | Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload | Pugongying X5 Pro | 7.3 (v4.0) | High |
| CVE-2025-12399 | Alex Reservations: Smart Restaurant Booking <= 2.2.3 - Authenticated (Admin+) Arbitrary File Upload | Alex Reservations: Smart Restaurant Booking | 7.2 (v3.1) | High |
| CVE-2026-13157 | Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload | Theme Demo Import | 7.2 (v3.1) | High |
| CVE-2026-13158 | Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload | Everest Toolkit | 7.2 (v3.1) | High |
| CVE-2026-7537 | MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Par | MDJM Event Management | 7.2 (v3.1) | High |
| CVE-2026-88396 | ApiAdmin 5.0 and Earlier Arbitrary Code Execution Vulnerability | - | 7.2 (v3.1) | High |
| CVE-2026-56702 | Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload | adminer | 7.1 (v4.0) | High |
| CVE-2025-34336 | eGovFramework <= 4.3.1 Unauthenticated File Upload via Web Editor Image Upload Endpoints | eGovFramework/egovframe-common-components | 6.9 (v4.0) | Medium |
| CVE-2026-90603 | Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload | Open-Generative-AI | 6.9 (v4.0) | Medium |
| CVE-2026-16548 | Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response Endpoint | Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat | 6.5 (v3.1) | Medium |
| CVE-2026-42538 | IRIS has an Insecure File Upload | iris-web | 6.3 (v3.1) | Medium |
| CVE-2025-10600 | SourceCodester Online Exam Form Submission register.php unrestricted upload | online exam form submission | 5.5 (v4.0) | Medium |
| CVE-2025-11318 | Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 uploadWxFile.do unrestricted upload | data leakage prevention system | 5.5 (v4.0) | Medium |
| CVE-2025-11656 | ProjectsAndPrograms School Management System editNotes.php unrestricted upload | school management system | 5.5 (v4.0) | Medium |
| CVE-2025-11657 | ProjectsAndPrograms School Management System createNotice.php unrestricted upload | school management system | 5.5 (v4.0) | Medium |
| CVE-2025-11658 | ProjectsAndPrograms School Management System changeSllyabus.php unrestricted upload | school management system | 5.5 (v4.0) | Medium |
| CVE-2025-11659 | ProjectsAndPrograms School Management System uploadNotes.php unrestricted upload | school management system | 5.5 (v4.0) | Medium |
| CVE-2025-11660 | ProjectsAndPrograms School Management System uploadSllyabus.php unrestricted upload | school management system | 5.5 (v4.0) | Medium |
| CVE-2025-12301 | code-projects Simple Food Ordering System editproduct.php unrestricted upload | simple food ordering system | 5.5 (v4.0) | Medium |
| CVE-2025-12378 | code-projects Simple Food Ordering System addproduct.php unrestricted upload | simple food ordering system | 5.5 (v4.0) | Medium |
| CVE-2025-14583 | campcodes Online Student Enrollment System register.php unrestricted upload | online student enrollment system | 5.5 (v4.0) | Medium |
| CVE-2025-15109 | jackq XCMS upload.php unrestricted upload | XCMS | 5.5 (v4.0) | Medium |
| CVE-2025-9772 | RemoteClinic edit.php unrestricted upload | remote clinic | 5.5 (v4.0) | Medium |
| CVE-2025-9775 | RemoteClinic edit-my-profile.php unrestricted upload | remote clinic | 5.5 (v4.0) | Medium |
| CVE-2026-0643 | projectworlds House Rental and Property Listing Signup register.php unrestricted upload | house rental and property listing project | 5.5 (v4.0) | Medium |
| CVE-2026-104637 | onetwothreeneth HospitalManagementSystem controller.php edit_patient unrestricted upload | HospitalManagementSystem | 5.5 (v4.0) | Medium |
| CVE-2026-114259 | oretnom23 file-management-system-php admin_class.php save_files unrestricted upload | file-management-system-php | 5.5 (v4.0) | Medium |
| CVE-2026-11474 | Kushan2k student-management-system Registration Endpoint RegisterService.php unrestricted upload | student-management-system | 5.5 (v4.0) | Medium |
| CVE-2026-13553 | itsourcecode Online Hotel Management System controller.php add unrestricted upload | Online Hotel Management System | 5.5 (v4.0) | Medium |
| CVE-2026-14736 | Ruijie RG-UAC user_auth_commit.php unrestricted upload | RG-UAC | 5.5 (v4.0) | Medium |
| CVE-2026-18788 | Trippo ResponsiveFilemanager dialog.php unrestricted upload | ResponsiveFilemanager | 5.5 (v4.0) | Medium |
| CVE-2026-5261 | Shandong Hoteam InforCenter PLM BaseHandler.ashx uploadFileToIIS unrestricted upload | InforCenter PLM | 5.5 (v4.0) | Medium |
| CVE-2026-5573 | Technostrobe HI-LED-WR120-G2 fs unrestricted upload | hi-led-wr120-g2 firmware | 5.5 (v4.0) | Medium |
| CVE-2026-6602 | rickxy Hospital Management System his_admin_account.php unrestricted upload | Hospital Management System | 5.5 (v4.0) | Medium |
| CVE-2026-78202 | itsourcecode Payroll System admin_class.php save_settings unrestricted upload | Payroll System | 5.5 (v4.0) | Medium |
| CVE-2026-78245 | itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload | Online Pharmacy System | 5.5 (v4.0) | Medium |
| CVE-2026-85208 | itsourcecode Online Medicine Delivery System Order Management Controller controller.php doInsert unrestricted upload | Online Medicine Delivery System | 5.5 (v4.0) | Medium |
| CVE-2026-86239 | liufee FeehiCMS UEditor Widget UeditorAction.php init unrestricted upload | FeehiCMS | 5.5 (v4.0) | Medium |
| CVE-2026-86305 | light0011 cms Upload.class.php upload unrestricted upload | cms | 5.5 (v4.0) | Medium |
| CVE-2026-86666 | aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload | iWebShop-5 | 5.5 (v4.0) | Medium |
| CVE-2026-8758 | Metasoft 美特软件 MetaCRM upload3.jsp unrestricted upload | MetaCRM | 5.5 (v4.0) | Medium |
| CVE-2026-36722 | bookcars v8.3 Arbitrary Code Execution Vulnerability | bookcars v8.3 | 5.4 (v3.1) | Medium |
| CVE-2025-11363 | Royal Elementor Addons and Templates < 1.7.1037 - Unauthenticated Media File Upload | Royal Addons for Elementor | 5.3 (v3.1) | Medium |
| CVE-2025-12655 | Hippoo Mobile App for WooCommerce <= 1.7.1 - Missing Authorization to Unauthenticated Limited File Write | Hippoo Mobile App for WooCommerce | 5.3 (v3.1) | Medium |
| CVE-2026-112247 | Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cr | Five-in-One Safety Production Management Information System | 5.3 (v4.0) | Medium |
| CVE-2026-55419 | Reachy Mini: Unrestricted Upload of File with Dangerous Type | reachy mini | 5.3 (v3.1) | Medium |
| CVE-2026-74908 | Grav plugin-api before 1.0.15 Script Injection via SVG | grav | 5.1 (v4.0) | Medium |
| CVE-2026-78337 | Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG | Prospero Flow CRM | 4.8 (v4.0) | Medium |
| CVE-2026-81931 | Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting | Prospero Flow CRM | 4.8 (v4.0) | Medium |
| CVE-2024-14046 | OpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted upload | OpenBoxes | 2.1 (v4.0) | Low |
| CVE-2025-11078 | itsourcecode Open Source Job Portal controller.php unrestricted upload | open source job portal | 2.1 (v4.0) | Low |
| CVE-2025-11320 | zhuimengshaonian wisdom-education UploadController.java uploadFile unrestricted upload | wisdom-education | 2.1 (v4.0) | Low |
| CVE-2025-11351 | code-projects Online Hotel Reservation System editpicexec.php unrestricted upload | online hotel reservation system | 2.1 (v4.0) | Low |
| CVE-2025-11352 | code-projects Online Hotel Reservation System addexec.php unrestricted upload | online hotel reservation system | 2.1 (v4.0) | Low |
| CVE-2025-11353 | code-projects Online Hotel Reservation System addgalleryexec.php unrestricted upload | online hotel reservation system | 2.1 (v4.0) | Low |
| CVE-2025-11354 | code-projects Online Hotel Reservation System addslideexec.php unrestricted upload | online hotel reservation system | 2.1 (v4.0) | Low |
| CVE-2025-11398 | SourceCodester Hotel and Lodge Management System Profile profile.php unrestricted upload | hotel and lodge management system | 2.1 (v4.0) | Low |
| CVE-2025-11417 | Campcodes Advanced Online Voting Management System voters_add.php unrestricted upload | advanced online voting system | 2.1 (v4.0) | Low |
| CVE-2025-11426 | projectworlds Advanced Library Management System edit_book.php unrestricted upload | advanced library management system | 2.1 (v4.0) | Low |
| CVE-2025-11630 | RainyGao DocSys File Upload uploadDoc.do updateRealDoc path traversal | docsys | 2.1 (v4.0) | Low |
| CVE-2025-11908 | Shenzhen Ruiming Technology Streamax Crocus FileDir.do uploadFile unrestricted upload | streamax crocus | 2.1 (v4.0) | Low |
| CVE-2025-12346 | MaxSite CMS HTTP Header uploads-require-maxsite.php unrestricted upload | maxsite cms | 2.1 (v4.0) | Low |
| CVE-2025-12347 | MaxSite CMS save-file-ajax.php unrestricted upload | maxsite cms | 2.1 (v4.0) | Low |
| CVE-2025-12862 | projectworlds Online Notes Sharing Platform userprofile.php unrestricted upload | online notes sharing platform | 2.1 (v4.0) | Low |
| CVE-2025-13061 | itsourcecode Online Voting System index.php unrestricted upload | online voting system | 2.1 (v4.0) | Low |
| CVE-2025-13238 | Bdtask Flight Booking Software Edit Profile edit unrestricted upload | flight booking software | 2.1 (v4.0) | Low |
| CVE-2025-13573 | projectworlds can pass malicious payloads add_book.php unrestricted upload | advanced library management system | 2.1 (v4.0) | Low |
| CVE-2025-13815 | moxi159753 Mogu Blog v2 pictures unrestricted upload | mogublog | 2.1 (v4.0) | Low |
| CVE-2025-13949 | ProudMuBai GoFilm FileController.go SingleUpload unrestricted upload | GoFilm | 2.1 (v4.0) | Low |
| CVE-2025-14195 | code-projects Employee Profile Management System add_file_query.php unrestricted upload | employee profile management system | 2.1 (v4.0) | Low |
| CVE-2025-14522 | baowzh hfly upload_json.php unrestricted upload | hfly | 2.1 (v4.0) | Low |
| CVE-2025-15050 | code-projects Student File Management System save_file.php unrestricted upload | student file management system | 2.1 (v4.0) | Low |
| CVE-2025-15129 | ChenJinchuang Lin-CMS-TP5 File Upload LocalUploader.php upload code injection | Lin-CMS-TP5 | 2.1 (v4.0) | Low |
| CVE-2025-15423 | EmpireSoft EmpireCMS connect.php CheckSaveTranFiletype unrestricted upload | empirecms | 2.1 (v4.0) | Low |
| CVE-2025-9800 | SimStudioAI sim HTML File route.ts import unrestricted upload | sim | 2.1 (v4.0) | Low |
| CVE-2026-101071 | Acrel Electric Unet Web Service Upload Endpoint upload unrestricted upload | Unet Web Service | 2.1 (v4.0) | Low |
| CVE-2026-103541 | formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload | Form Tools | 2.1 (v4.0) | Low |
| CVE-2026-105174 | Gerapy Project Management views.py project_create path traversal | Gerapy | 2.1 (v4.0) | Low |
| CVE-2026-105389 | feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload | feelcrm-os | 2.1 (v4.0) | Low |
| CVE-2026-10806 | mjperpinosa stumasy add_post.php unrestricted upload | stumasy | 2.1 (v4.0) | Low |
| CVE-2026-10807 | mjperpinosa stumasy change_profile_image.php unrestricted upload | stumasy | 2.1 (v4.0) | Low |
| CVE-2026-116057 | KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload | KodExplorer | 2.1 (v4.0) | Low |
| CVE-2026-116113 | GouGuOA Api.php chunkUpload unrestricted upload | GouGuOA | 2.1 (v4.0) | Low |
| CVE-2026-14776 | SourceCodester Onlne Examination & Learning Management System Filename Extension upload_files.php pathinfo unrestricted | Onlne Examination & Learning Management System | 2.1 (v4.0) | Low |
| CVE-2026-14777 | SourceCodester Onlne Examination & Learning Management System announcements.php unrestricted upload | Onlne Examination & Learning Management System | 2.1 (v4.0) | Low |
| CVE-2026-16451 | zsadmin2025 ZS-Admin com.zs.file.controller.SysFileController upload unrestricted upload | ZS-Admin | 2.1 (v4.0) | Low |
| CVE-2026-19210 | SourceCodester Photo Share Website ajax.php save_upload unrestricted upload | Photo Share Website | 2.1 (v4.0) | Low |
| CVE-2026-5670 | Cyber-III Student-Management-System upload.php move_uploaded_file unrestricted upload | Student-Management-System | 2.1 (v4.0) | Low |
| CVE-2026-7107 | code-projects Invoice System in Laravel company unrestricted upload | Invoice System in Laravel | 2.1 (v4.0) | Low |
| CVE-2026-7732 | code-projects BloodBank Managing System request_blood.php unrestricted upload | BloodBank Managing System | 2.1 (v4.0) | Low |
| CVE-2026-77681 | CodeAstro Online Job Portal update-profile.php unrestricted upload | Online Job Portal | 2.1 (v4.0) | Low |
| CVE-2026-82679 | diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload | diem | 2.1 (v4.0) | Low |
| CVE-2026-85186 | itsourcecode Online Medicine Delivery System Customer Controller controller.php doupdateimage unrestricted upload | Online Medicine Delivery System | 2.1 (v4.0) | Low |
| CVE-2026-90500 | lenve vhr Avatar Upload userface FastDFSUtils.upload unrestricted upload | vhr | 2.1 (v4.0) | Low |
| CVE-2026-90857 | SourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted upload | College Notes Gallery Management System | 2.1 (v4.0) | Low |
| CVE-2026-91005 | SourceCodester Online Faculty Clearance System Profile Picture Upload edit_picture.php move_uploaded_file unrestricted u | Online Faculty Clearance System | 2.1 (v4.0) | Low |
| CVE-2026-91849 | WuzhiCMS Avatar Upload index.php setAvatar unrestricted upload | WuzhiCMS | 2.1 (v4.0) | Low |
| CVE-2025-11103 | Projectworlds Online Tours and Travels change-image.php unrestricted upload | online tours and travels | 2.0 (v4.0) | Low |
| CVE-2025-11136 | YiFang CMS Backend File.php webUploader unrestricted upload | yifang | 2.0 (v4.0) | Low |
| CVE-2025-11508 | code-projects Voting System voters_add.php unrestricted upload | voting system | 2.0 (v4.0) | Low |
| CVE-2025-12593 | code-projects Simple Online Hotel Reservation System Photo edit_room.php unrestricted upload | simple online hotel reservation system | 2.0 (v4.0) | Low |
| CVE-2025-13185 | Bdtask/CodeCanyon News365 profile unrestricted upload | news365 | 2.0 (v4.0) | Low |
| CVE-2025-14219 | Campcodes Retro Basketball Shoes Online Store admin_running.php unrestricted upload | retro basketball shoes online store | 2.0 (v4.0) | Low |
| CVE-2025-14530 | SourceCodester Real Estate Property Listing App property.php unrestricted upload | real estate property listing app | 2.0 (v4.0) | Low |
| CVE-2025-14582 | campcodes Online Student Enrollment System index.php unrestricted upload | online student enrollment system | 2.0 (v4.0) | Low |
| CVE-2025-15110 | jackq XCMS Backend ProductImageController.class.php upload unrestricted upload | xcms | 2.0 (v4.0) | Low |
| CVE-2025-15197 | code-projects/anirbandutta9 Content Management System/News-Buzz editposts.php unrestricted upload | news-buzz | 2.0 (v4.0) | Low |
| CVE-2026-116603 | SourceCodester Online Food Ordering System add_food.php unrestricted upload | Online Food Ordering System | 2.0 (v4.0) | Low |
| CVE-2026-15518 | AREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted upload | Twill CMS | 2.0 (v4.0) | Low |
| CVE-2026-19383 | saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload | SaiAdmin | 2.0 (v4.0) | Low |
| CVE-2026-19839 | SourceCodester Simple Doctors Appointment System save_file.php save_doctor unrestricted upload | Simple Doctors Appointment System | 2.0 (v4.0) | Low |
| CVE-2026-5576 | SourceCodester/jkev Record Management System Add Employee save_emp.php unrestricted upload | Record Management System | 2.0 (v4.0) | Low |
| CVE-2026-7238 | code-projects Online Music Site AdminUpdateAlbum.php unrestricted upload | Online Music Site | 2.0 (v4.0) | Low |
| CVE-2026-76995 | SourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted upload | Simple Online Food Ordering System | 2.0 (v4.0) | Low |
| CVE-2026-82629 | jeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload | jeewx-boot | 2.0 (v4.0) | Low |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.
Documentation Source
- Original wiki page: WAF 351000
- Source revision: 2695
- Source revision date: 2012-09-18