On this page

Atomicorp WAF Rule 351000

Rule Summary

  • Rule ID: 351000
  • Status: Active
  • Alert message: Atomicorp.com Upload Malware Scanner: Malicious File upload attempt detected and blocked
  • Observed CWEs: CWE-20 (1), CWE-22 (1), CWE-73 (1), CWE-79 (1), CWE-284 (23), CWE-306 (5), CWE-352 (1), CWE-434 (54)
  • Revision: 2
  • Rule severity: Critical (2)
  • Phase: 2 (request body)
  • Rule action: deny
  • HTTP status: 403
  • Logging: log, auditlog

Description

This rule detects behavior identified by its current alert as “Atomicorp.com Upload Malware Scanner: Malicious File upload attempt detected and blocked”. It evaluates during the request body phase and denies matching traffic with HTTP status 403.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

CVEVulnerabilityProductCVSSSeverity
CVE-2025-34163Dongsheng Logistics Software Unauthenticated Arbitrary File UploadDongsheng Logistics Software10.0 (v4.0)Critical
CVE-2026-57827Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12rsfiles!10.0 (v4.0)Critical
CVE-2015-10138Work The Flow File Upload <= 2.5.2 - Arbitrary File Uploadwork the flow file upload9.8 (v3.1)Critical
CVE-2025-9314Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File UploadThe Developer Tools WordPress plugin through 1.1.39.8 (v3.1)Critical
CVE-2026-36669ck_upload_handler.php in Feng Office 3.11.13.11 Arbitrary File Upload Vulnerabilityck upload handler.php in Feng Office 3.11.13.119.8 (v3.1)Critical
CVE-2026-49827WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)WebErpMesv29.8 (v3.1)Critical
CVE-2026-50894easyadmin v2.0.2.2 Arbitrary Code Execution Vulnerability-9.8 (v3.1)Critical
CVE-2026-67678RainyGao-Hithub DocSys v.2.02.80 Arbitrary Code Execution VulnerabilityRainyGao-Hithub DocSys v.2.02.809.8 (v3.1)Critical
CVE-2026-75327In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java Arbitrary File Upload VulnerabilityIn DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java9.8 (v3.1)Critical
CVE-2016-20052Snews CMS 1.7 Unrestricted File Upload via snews_filessnews9.3 (v4.0)Critical
CVE-2018-25412Delta Sql 1.8.2 Arbitrary File Upload via docs_upload.phpdeltasql9.3 (v4.0)Critical
CVE-2021-47940WordPress Download From Files 1.48 Arbitrary File UploadDownload From Files9.3 (v4.0)Critical
CVE-2022-4995Weaver E-cology 9.0 File Upload RCE via uploaderOperate.jspE-cology 9.09.3 (v4.0)Critical
CVE-2026-70558Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default TokenDinky9.3 (v4.0)Critical
CVE-2026-49849xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Executionxshop9.1 (v3.1)Critical
CVE-2025-70151scholars tracking system Arbitrary Code Execution Vulnerabilityscholars tracking system8.8 (v3.1)High
CVE-2026-55676Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload componentMalcolm8.8 (v3.1)High
CVE-2026-60009theia Arbitrary Code Execution Vulnerabilitytheia8.8 (v3.1)High
CVE-2026-72557Cockpit CMS Cockpit CMS - Unrestricted File UploadCockpit CMS8.8 (v3.1)High
CVE-2018-25409SIM-PKH 2.4.1 Arbitrary File Upload via aksi_pengurus.phpSIM-PKH8.7 (v4.0)High
CVE-2019-25673UniSharp Laravel File Manager v2.0.0-alpha7 Arbitrary File UploadLaravel File Manager8.7 (v4.0)High
CVE-2026-26212Rara One Click Demo Import < 1.3.5 Arbitrary File Upload RCERara One Click Demo Import8.6 (v4.0)High
CVE-2026-63429HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form contextheyform8.6 (v3.1)High
CVE-2026-82524UnoPim File Upload RCE via TinyMCE Image Upload Endpointunopim8.6 (v4.0)High
CVE-2026-13157Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File UploadTheme Demo Import7.2 (v3.1)High
CVE-2026-13158Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File UploadEverest Toolkit7.2 (v3.1)High
CVE-2026-7537MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' ParMDJM Event Management7.2 (v3.1)High
CVE-2026-56702Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUploadadminer7.1 (v4.0)High
CVE-2026-16548Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response EndpointChat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat6.5 (v3.1)Medium
CVE-2026-42538IRIS has an Insecure File Uploadiris-web6.3 (v3.1)Medium
CVE-2026-11474Kushan2k student-management-system Registration Endpoint RegisterService.php unrestricted uploadstudent-management-system5.5 (v4.0)Medium
CVE-2026-18788Trippo ResponsiveFilemanager dialog.php unrestricted uploadResponsiveFilemanager5.5 (v4.0)Medium
CVE-2026-5573Technostrobe HI-LED-WR120-G2 fs unrestricted uploadhi-led-wr120-g2 firmware5.5 (v4.0)Medium
CVE-2026-78202itsourcecode Payroll System admin_class.php save_settings unrestricted uploadPayroll System5.5 (v4.0)Medium
CVE-2026-78245itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted uploadOnline Pharmacy System5.5 (v4.0)Medium
CVE-2026-85208itsourcecode Online Medicine Delivery System Order Management Controller controller.php doInsert unrestricted uploadOnline Medicine Delivery System5.5 (v4.0)Medium
CVE-2026-86239liufee FeehiCMS UEditor Widget UeditorAction.php init unrestricted uploadFeehiCMS5.5 (v4.0)Medium
CVE-2026-86305light0011 cms Upload.class.php upload unrestricted uploadcms5.5 (v4.0)Medium
CVE-2026-86666aircheng-org iWebShop-5 pic.php uploadFile unrestricted uploadiWebShop-55.5 (v4.0)Medium
CVE-2026-36722the /api/create-car-image component of bookcars v8.3 Arbitrary Code Execution Vulnerabilitythe /api/create-car-image component of bookcars v8.35.4 (v3.1)Medium
CVE-2026-55419Reachy Mini: Unrestricted Upload of File with Dangerous Typereachy mini5.3 (v3.1)Medium
CVE-2026-74908Grav plugin-api before 1.0.15 Script Injection via SVGgrav5.1 (v4.0)Medium
CVE-2026-78337Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVGProspero Flow CRM4.8 (v4.0)Medium
CVE-2026-81931Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scriptingProspero Flow CRM4.8 (v4.0)Medium
CVE-2024-14046OpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted uploadOpenBoxes2.1 (v4.0)Low
CVE-2025-13815moxi159753 Mogu Blog v2 pictures unrestricted uploadmogublog2.1 (v4.0)Low
CVE-2026-10806mjperpinosa stumasy add_post.php unrestricted uploadstumasy2.1 (v4.0)Low
CVE-2026-10807mjperpinosa stumasy change_profile_image.php unrestricted uploadstumasy2.1 (v4.0)Low
CVE-2026-16451zsadmin2025 ZS-Admin com.zs.file.controller.SysFileController upload unrestricted uploadZS-Admin2.1 (v4.0)Low
CVE-2026-19210SourceCodester Photo Share Website ajax.php save_upload unrestricted uploadPhoto Share Website2.1 (v4.0)Low
CVE-2026-77681CodeAstro Online Job Portal update-profile.php unrestricted uploadOnline Job Portal2.1 (v4.0)Low
CVE-2026-82679diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted uploaddiem2.1 (v4.0)Low
CVE-2026-85186itsourcecode Online Medicine Delivery System Customer Controller controller.php doupdateimage unrestricted uploadOnline Medicine Delivery System2.1 (v4.0)Low
CVE-2026-19383saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted uploadSaiAdmin2.0 (v4.0)Low
CVE-2026-19839SourceCodester Simple Doctors Appointment System save_file.php save_doctor unrestricted uploadSimple Doctors Appointment System2.0 (v4.0)Low
CVE-2026-5576SourceCodester/jkev Record Management System Add Employee save_emp.php unrestricted uploadRecord Management System2.0 (v4.0)Low
CVE-2026-76995SourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted uploadSimple Online Food Ordering System2.0 (v4.0)Low
CVE-2026-82629jeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted uploadjeewx-boot2.0 (v4.0)Low

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

CWERelated Published CVEs
CWE-20CVE-2026-49827
CWE-22CVE-2026-60009
CWE-73CVE-2026-60009
CWE-79CVE-2026-74908
CWE-284CVE-2026-11474 , CVE-2026-18788 , CVE-2026-5573 , CVE-2026-78202 , CVE-2026-78245 , CVE-2026-85208 , CVE-2026-86239 , CVE-2026-86305 , CVE-2026-86666 , CVE-2024-14046 , CVE-2025-13815 , CVE-2026-10806 , CVE-2026-10807 , CVE-2026-16451 , CVE-2026-19210 , CVE-2026-77681 , CVE-2026-82679 , CVE-2026-85186 , CVE-2026-19383 , CVE-2026-19839 , CVE-2026-5576 , CVE-2026-76995 , CVE-2026-82629
CWE-306CVE-2026-49827 , CVE-2018-25412 , CVE-2021-47940 , CVE-2026-60009 , CVE-2026-63429
CWE-352CVE-2026-60009
CWE-434CVE-2025-34163 , CVE-2026-57827 , CVE-2015-10138 , CVE-2025-9314 , CVE-2026-36669 , CVE-2026-49827 , CVE-2026-50894 , CVE-2026-67678 , CVE-2026-75327 , CVE-2016-20052 , CVE-2022-4995 , CVE-2026-70558 , CVE-2026-49849 , CVE-2025-70151 , CVE-2026-55676 , CVE-2026-72557 , CVE-2018-25409 , CVE-2019-25673 , CVE-2026-26212 , CVE-2026-63429 , CVE-2026-82524 , CVE-2026-13157 , CVE-2026-13158 , CVE-2026-7537 , CVE-2026-56702 , CVE-2026-16548 , CVE-2026-42538 , CVE-2026-11474 , CVE-2026-18788 , CVE-2026-5573 , CVE-2026-78202 , CVE-2026-78245 , CVE-2026-85208 , CVE-2026-86239 , CVE-2026-86305 , CVE-2026-86666 , CVE-2026-36722 , CVE-2026-55419 , CVE-2026-78337 , CVE-2026-81931 , CVE-2024-14046 , CVE-2025-13815 , CVE-2026-10806 , CVE-2026-10807 , CVE-2026-16451 , CVE-2026-19210 , CVE-2026-77681 , CVE-2026-82679 , CVE-2026-85186 , CVE-2026-19383 , CVE-2026-19839 , CVE-2026-5576 , CVE-2026-76995 , CVE-2026-82629

Documentation Source

  • Original wiki page: WAF 351000
  • Source revision: 2695
  • Source revision date: 2012-09-18