On this page
Atomicorp WAF Rule 360152
Rule Summary
- Rule ID: 360152
- Status: Active
- Alert message: Atomicorp.com WAF Rules: PHP Injection Attack: Variables Found
- Observed CWEs: CWE-19 (1), CWE-20 (9), CWE-22 (14), CWE-73 (1), CWE-74 (3), CWE-77 (6), CWE-78 (11), CWE-79 (1), CWE-88 (1), CWE-89 (7), CWE-91 (1), CWE-94 (18), CWE-95 (1), CWE-98 (1), CWE-119 (2), CWE-144 (1), CWE-178 (1), CWE-200 (2), CWE-255 (6), CWE-264 (7), CWE-269 (2), CWE-284 (3), CWE-285 (1), CWE-287 (6), CWE-288 (2), CWE-290 (1), CWE-306 (7), CWE-352 (1), CWE-425 (1), CWE-434 (35), CWE-494 (1), CWE-502 (7), CWE-522 (1), CWE-532 (1), CWE-552 (1), CWE-668 (1), CWE-732 (1), CWE-749 (1), CWE-798 (3), CWE-829 (2), CWE-863 (3), CWE-915 (1), CWE-917 (1)
- Revision: 6
- Rule severity: Critical (2)
- Phase: 2 (request body)
- Request surfaces: Request cookies, Request argument names, Request arguments, JSON request data, SOAP request data, XML request data
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “PHP Injection Attack: Variables Found” in the request cookies, request argument names, request arguments, JSON request data, SOAP request data, XML request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2009-3843 | Apache Tomcat Manager Authenticated Upload Code Execution | operations manager | 10.0 (v2.0) | High |
| CVE-2009-4188 | Apache Tomcat Manager Authenticated Upload Code Execution | operations dashboard | 10.0 (v2.0) | High |
| CVE-2009-4189 | Apache Tomcat Manager Authenticated Upload Code Execution | operations manager | 10.0 (v2.0) | High |
| CVE-2010-0219 | Axis2 / SAP BusinessObjects Authenticated Code Execution (via SOAP) | axis2 | 10.0 (v2.0) | High |
| CVE-2010-5324 | Novell ZENworks Configuration Management Remote Execution | zenworks configuration management | 10.0 (v2.0) | High |
| CVE-2012-3260 | HP SiteScope Remote Code Execution | sitescope | 10.0 (v2.0) | High |
| CVE-2012-3261 | HP SiteScope Remote Code Execution | sitescope | 10.0 (v2.0) | High |
| CVE-2012-5201 | HP Intelligent Management Center Arbitrary File Upload | intelligent management center | 10.0 (v2.0) | High |
| CVE-2012-5692 | Invision IP.Board unserialize() PHP Code Execution | invision power board | 10.0 (v2.0) | High |
| CVE-2013-10040 | ClipBucket Remote Code Execution | clipbucket | 10.0 (v4.0) | Critical |
| CVE-2015-2284 | Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability | firewall security manager | 10.0 (v2.0) | High |
| CVE-2011-3923 | Apache Struts ParametersInterceptor Remote Code Execution | struts | 9.8 (v3.1) | Critical |
| CVE-2012-0911 | Tiki Wiki unserialize() PHP Code Execution | tikiwiki cms/groupware | 9.8 (v3.1) | Critical |
| CVE-2012-1495 | WebCalendar 1.2.4 Pre-Auth Remote Code Injection | webcalendar | 9.8 (v3.1) | Critical |
| CVE-2012-6710 | eXtplorer v2.1 Arbitrary File Upload Vulnerability | extplorer | 9.8 (v3.0) | Critical |
| CVE-2013-1359 | SonicWALL GMS 6 Arbitrary File Upload | analyzer | 9.8 (v3.1) | Critical |
| CVE-2013-7390 | ManageEngine Desktop Central AgentLogUpload Arbitrary File Upload | manageengine desktop central | 9.8 (v3.1) | Critical |
| CVE-2015-2857 | Accellion FTA getStatus verify_oauth_token Command Execution | file transfer appliance | 9.8 (v3.1) | Critical |
| CVE-2015-3933 | GeniXCMS 0.0.3 - 'register.php' SQL Injection | genixcms | 9.8 (v3.0) | Critical |
| CVE-2015-6922 | Kaseya VSA uploader.aspx Arbitrary File Upload | virtual system administrator | 9.8 (v3.1) | Critical |
| CVE-2015-8249 | ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability | desktop central | 9.8 (v3.0) | Critical |
| CVE-2016-15043 | WordPress WP Mobile Detector 3.5 Shell Upload | wp mobile detector | 9.8 (v3.1) | Critical |
| CVE-2016-3087 | Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution | struts | 9.8 (v3.0) | Critical |
| CVE-2016-3088 | ActiveMQ Arbitrary File Write Vulnerability (CVE-2016-3088) | activemq | 9.8 (v3.1) | Critical |
| CVE-2017-1092 | IBM OpenAdmin Tool SOAP welcomeServer PHP Code Execution | informix open admin tool | 9.8 (v3.0) | Critical |
| CVE-2017-17560 | Western Digital MyCloud multi_uploadify File Upload Vulnerability | my cloud pr4100 firmware | 9.8 (v3.0) | Critical |
| CVE-2018-14933 | NUUO NVRmini upgrade_handle.php Remote Command Execution | nvrmini firmware | 9.8 (v3.1) | Critical |
| CVE-2018-15708 | Nagios XI Magpie_debug.php Root Remote Code Execution | nagios xi | 9.8 (v3.0) | Critical |
| CVE-2019-11231 | GetSimpleCMS Unauthenticated RCE | getsimple cms | 9.8 (v3.0) | Critical |
| CVE-2019-1619 | Cisco Data Center Network Manager Unauthenticated Remote Code Execution | data center network manager | 9.8 (v3.1) | Critical |
| CVE-2019-1620 | Cisco Data Center Network Manager Unauthenticated Remote Code Execution | data center network manager | 9.8 (v3.1) | Critical |
| CVE-2020-16152 | Aerohive NetConfig 10.0r8a LFI and log poisoning to RCE | aerohive netconfig | 9.8 (v3.1) | Critical |
| CVE-2020-28188 | TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution | tos | 9.8 (v3.1) | Critical |
| CVE-2020-28871 | Monitorr unauthenticated Remote Code Execution (RCE) | monitorr | 9.8 (v3.1) | Critical |
| CVE-2020-35665 | TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution | terramaster operating system | 9.8 (v3.1) | Critical |
| CVE-2020-35846 | Cockpit CMS NoSQLi to RCE | cockpit | 9.8 (v3.1) | Critical |
| CVE-2020-35847 | Cockpit CMS NoSQLi to RCE | cockpit | 9.8 (v3.1) | Critical |
| CVE-2020-36847 | WordPress Simple File List Unauthenticated Remote Code Execution | simple file list | 9.8 (v3.1) | Critical |
| CVE-2020-4427 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.8 (v3.1) | Critical |
| CVE-2020-4429 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.8 (v3.1) | Critical |
| CVE-2020-8518 | Horde CSV import arbitrary PHP code execution | groupware | 9.8 (v3.1) | Critical |
| CVE-2021-1472 | Cisco Small Business RV Series Authentication Bypass and Command Injection | rv160 firmware | 9.8 (v3.1) | Critical |
| CVE-2021-1473 | Cisco Small Business RV Series Authentication Bypass and Command Injection | rv340 firmware | 9.8 (v3.1) | Critical |
| CVE-2022-24637 | Open Web Analytics 1.7.3 - Remote Code Execution (RCE) | open web analytics | 9.8 (v3.1) | Critical |
| CVE-2022-31814 | pfSense plugin pfBlockerNG unauthenticated RCE as root | pfblockerng | 9.8 (v3.1) | Critical |
| CVE-2022-37061 | FLIR AX8 unauthenticated RCE | flir ax8 firmware | 9.8 (v3.1) | Critical |
| CVE-2022-39952 | Fortinet FortiNAC keyUpload.jsp arbitrary file write | fortinac | 9.8 (v3.1) | Critical |
| CVE-2022-40471 | Clinic's Patient Management System 1.0 - Unauthenticated RCE | clinic's patient management system | 9.8 (v3.1) | Critical |
| CVE-2023-22515 | Atlassian Confluence Unauthenticated Remote Code Execution | confluence data center | 9.8 (v3.1) | Critical |
| CVE-2023-22518 | Atlassian Confluence Unauth JSON setup-restore Improper Authorization leading to RCE (CVE-2023-22518) | confluence data center | 9.8 (v3.1) | Critical |
| CVE-2023-23333 | SolarView Compact unauthenticated remote command execution vulnerability. | solarview compact firmware | 9.8 (v3.1) | Critical |
| CVE-2023-26469 | Jorani unauthenticated Remote Code Execution | jorani | 9.8 (v3.1) | Critical |
| CVE-2023-34960 | Chamilo unauthenticated command injection in PowerPoint upload | chamilo | 9.8 (v3.1) | Critical |
| CVE-2024-0204 | Fortra GoAnywhere MFT Unauthenticated Remote Code Execution | goanywhere managed file transfer | 9.8 (v3.1) | Critical |
| CVE-2024-10924 | WordPress Really Simple SSL Plugin Authentication Bypass to RCE | really simple security | 9.8 (v3.1) | Critical |
| CVE-2024-11680 | ProjectSend r1295 - r1605 Unauthenticated Remote Code Execution | projectsend | 9.8 (v3.1) | Critical |
| CVE-2024-2054 | Artica Proxy Unauthenticated PHP Deserialization Vulnerability | artica proxy | 9.8 (v3.1) | Critical |
| CVE-2024-23759 | Gambio Online Webshop unauthenticated PHP Deserialization Vulnerability | gambio | 9.8 (v3.1) | Critical |
| CVE-2024-27198 | JetBrains TeamCity Unauthenticated Remote Code Execution | teamcity | 9.8 (v3.1) | Critical |
| CVE-2024-3116 | pgAdmin Binary Path API RCE | pgadmin 4 | 9.8 (v3.1) | Critical |
| CVE-2024-3408 | D-Tale RCE | d-tale | 9.8 (v3.1) | Critical |
| CVE-2024-4358 | Telerik Report Server Auth Bypass and Deserialization RCE | report server 2024 | 9.8 (v3.1) | Critical |
| CVE-2024-44000 | Wordpress LiteSpeed Cache plugin cookie theft | litespeed cache | 9.8 (v3.1) | Critical |
| CVE-2024-6127 | PowerShellEmpire Arbitrary File Upload (Skywalker) | Empire | 9.8 (v3.1) | Critical |
| CVE-2025-11749 | WordPress AI Engine Plugin MCP Unauthenticated Admin Creation to RCE | AI Engine – The Chatbot, AI Framework & MCP for WordPress | 9.8 (v3.1) | Critical |
| CVE-2025-62521 | ChurchCRM Unauthenticated RCE via Setup Page | churchcrm | 9.8 (v3.1) | Critical |
| CVE-2025-7441 | WordPress StoryChief Plugin Unauthenticated RCE | StoryChief | 9.8 (v3.1) | Critical |
| CVE-2025-34074 | Lucee Authenticated Scheduled Job Code Execution | Lucee | 9.4 (v4.0) | Critical |
| CVE-2025-34104 | Piwik Superuser Plugin Upload | Web Analytics Platform | 9.4 (v4.0) | Critical |
| CVE-2026-19681 | Tenable Security Center SCAP Audit File Command Injection | security center | 9.4 (v4.0) | Critical |
| CVE-2009-20006 | osCommerce 2.2 Arbitrary PHP Code Execution | osCommerce | 9.3 (v4.0) | Critical |
| CVE-2009-3068 | Adobe RoboHelp Server 8 Arbitrary File Upload and Execute | robohelp server | 9.3 (v2.0) | High |
| CVE-2013-10034 | Kaseya uploadImage Arbitrary File Upload | KServer | 9.3 (v4.0) | Critical |
| CVE-2013-10051 | InstantCMS 1.6 Remote PHP Code Execution | instantcms | 9.3 (v4.0) | Critical |
| CVE-2013-10054 | LibrettoCMS File Manager Arbitary File Upload Vulnerability | LibrettoCMS | 9.3 (v4.0) | Critical |
| CVE-2014-125113 | Dell KACE K1000 File Upload | KACE K1000 Systems Management Appliance | 9.3 (v4.0) | Critical |
| CVE-2014-125116 | HybridAuth install.php PHP Code Execution | HybridAuth | 9.3 (v4.0) | Critical |
| CVE-2025-25034 | SugarCRM REST Unserialize PHP Code Execution | SugarCRM | 9.3 (v4.0) | Critical |
| CVE-2025-34121 | Idera Up.Time Monitoring Station 7.0 post2file.php Arbitrary File Upload | Up.Time Monitoring Station | 9.3 (v4.0) | Critical |
| CVE-2026-29014 | MetInfo CMS <= 8.1 - Remote Code Execution | metinfo | 9.3 (v4.0) | Critical |
| CVE-2026-27760 | OpenCATS Installer PHP Code Injection | OpenCATS | 9.2 (v4.0) | Critical |
| CVE-2020-4428 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.1 (v3.1) | Critical |
| CVE-2025-54236 | Magento SessionReaper | commerce | 9.1 (v3.1) | Critical |
| CVE-2008-4687 | Mantis manage_proj_page PHP Code Execution | mantis | 9.0 (v2.0) | High |
| CVE-2010-1871 | JBoss Seam 2 File Upload and Execute | jboss enterprise application platform | 8.8 (v3.1) | High |
| CVE-2013-3629 | ISPConfig Authenticated Arbitrary PHP Code Execution | ispconfig | 8.8 (v3.1) | High |
| CVE-2015-6000 | Vtiger CRM - Authenticated Logo Upload RCE | vtiger crm | 8.8 (v3.1) | High |
| CVE-2017-16524 | Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload | web viewer | 8.8 (v3.0) | High |
| CVE-2017-6090 | phpCollab 2.5.1 Unauthenticated File Upload | phpcollab | 8.8 (v3.0) | High |
| CVE-2018-15142 | OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions | openemr | 8.8 (v3.0) | High |
| CVE-2019-10267 | Ahsay Backup v7.x-v8.1.1.50 (authenticated) file upload | cloud backup suite | 8.8 (v3.0) | High |
| CVE-2020-14321 | Moodle Teacher Enrollment Privilege Escalation to RCE | moodle | 8.8 (v3.1) | High |
| CVE-2020-27386 | FlexDotnetCMS Arbitrary ASP File Upload | flexdotnetcms | 8.8 (v3.1) | High |
| CVE-2020-27387 | HorizontCMS Arbitrary PHP File Upload | horizontcms | 8.8 (v3.1) | High |
| CVE-2021-24347 | Wordpress Plugin SP Project and Document - Authenticated Remote Code Execution | sp project & document manager | 8.8 (v3.1) | High |
| CVE-2021-37343 | Nagios XI Autodiscovery Webshell Upload | nagios xi | 8.8 (v3.1) | High |
| CVE-2021-41282 | pfSense Diag Routes Web Shell Upload | pfsense | 8.8 (v3.1) | High |
| CVE-2021-43258 | ChurchInfo 1.2.13-1.3.0 Authenticated RCE | churchinfo | 8.8 (v3.1) | High |
| CVE-2022-0824 | Webmin File Manager RCE | webmin | 8.8 (v3.1) | High |
| CVE-2023-22952 | SugarCRM unauthenticated Remote Code Execution (RCE) | sugarcrm | 8.8 (v3.1) | High |
| CVE-2023-32707 | Splunk "edit_user" Capability Privilege Escalation | splunk | 8.8 (v3.1) | High |
| CVE-2023-38836 | BoidCMS Command Injection | boidcms | 8.8 (v3.1) | High |
| CVE-2023-46214 | Splunk Authenticated XSLT Upload RCE | cloud | 8.8 (v3.1) | High |
| CVE-2023-49084 | Cacti RCE via SQLi in pollers.php | cacti | 8.8 (v3.1) | High |
| CVE-2023-49085 | Cacti RCE via SQLi in pollers.php | cacti | 8.8 (v3.1) | High |
| CVE-2024-1800 | Telerik Report Server Auth Bypass and Deserialization RCE | telerik report server | 8.8 (v3.1) | High |
| CVE-2024-21683 | Atlassian Confluence Administrator Code Macro Remote Code Execution | confluence data center | 8.8 (v3.1) | High |
| CVE-2025-34511 | Sitecore XP CVE-2025-34511 Post-Authentication File Upload | experience commerce | 8.8 (v3.1) | High |
| CVE-2025-49113 | Roundcube Post-Auth RCE via PHP Object Deserialization | webmail | 8.8 (v3.1) | High |
| CVE-2013-10032 | GetSimpleCMS PHP File Upload Vulnerability | getsimplecms | 8.7 (v4.0) | High |
| CVE-2025-24367 | Cacti Graph Template authenticated RCE versions prior to 1.2.29 | cacti | 8.7 (v4.0) | High |
| CVE-2015-8279 | Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload | web viewer | 8.6 (v3.0) | High |
| CVE-2025-34097 | ProcessMaker Plugin Upload | ProcessMaker | 8.6 (v4.0) | High |
| CVE-2016-3081 | Apache Struts Dynamic Method Invocation Remote Code Execution | agile controller-campus firmware | 8.1 (v3.1) | High |
| CVE-2024-43425 | Moodle Remote Code Execution (CVE-2024-43425) | moodle | 8.1 (v3.1) | High |
| CVE-2025-2563 | WP User Registration and Membership Unauthenticated Privilege Escalation (CVE-2025-2563) | user registration & membership | 8.1 (v3.1) | High |
| CVE-2018-15710 | Nagios XI Magpie_debug.php Root Remote Code Execution | nagios xi | 7.8 (v3.0) | High |
| CVE-2019-9624 | Webmin Upload Authenticated RCE | webmin | 7.8 (v3.0) | High |
| CVE-2003-0050 | QuickTime Streaming Server parse_xml.cgi Remote Execution | darwin streaming server | 7.5 (v2.0) | High |
| CVE-2005-2733 | Simple PHP Blog Remote Command Execution | simple php blog | 7.5 (v2.0) | High |
| CVE-2007-1036 | JBoss JMX Console Deployer Upload and Execute | jboss application server | 7.5 (v2.0) | High |
| CVE-2008-6508 | Openfire Admin Console Authentication Bypass | openfire | 7.5 (v2.0) | High |
| CVE-2009-3548 | Apache Tomcat Manager Authenticated Upload Code Execution | tomcat | 7.5 (v2.0) | High |
| CVE-2009-4140 | OpenEMR PHP File Upload Vulnerability | open flash chart | 7.5 (v2.0) | High |
| CVE-2010-0557 | Apache Tomcat Manager Authenticated Upload Code Execution | cognos express | 7.5 (v2.0) | High |
| CVE-2010-4417 | Oracle BeeHive 2 voice-servlet processEvaluation() Vulnerability | beehive | 7.5 (v2.0) | High |
| CVE-2011-4075 | phpLDAPadmin query_engine Remote PHP Code Injection | phpldapadmin | 7.5 (v2.0) | High |
| CVE-2011-4448 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 7.5 (v2.0) | High |
| CVE-2012-5223 | vBSEO proc_deutf() Remote PHP Code Injection | vbseo | 7.5 (v2.0) | High |
| CVE-2013-3520 | VMware vCenter Chargeback Manager ImageUploadServlet Arbitrary File Upload | vcenter chargeback manager | 7.5 (v2.0) | High |
| CVE-2013-4557 | SPIP connect Parameter PHP Injection | spip | 7.5 (v2.0) | High |
| CVE-2014-1691 | Horde Framework Unserialize PHP Code Execution | horde application framework | 7.5 (v2.0) | High |
| CVE-2014-5005 | ManageEngine Desktop Central StatusUpdate Arbitrary File Upload | manageengine desktop central | 7.5 (v2.0) | High |
| CVE-2014-6446 | Wordpress InfusionSoft Upload Vulnerability | infusionsoft gravity forms | 7.5 (v2.0) | High |
| CVE-2014-7146 | MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability | mantisbt | 7.5 (v2.0) | High |
| CVE-2014-9567 | ProjectSend Arbitrary File Upload | projectsend | 7.5 (v2.0) | High |
| CVE-2015-1518 | RedaxScript CMS 2.2.0 - SQL Injection | redaxscript | 7.5 (v2.0) | High |
| CVE-2015-2824 | WordPress Plugin Simple Ads Manager - Multiple SQL Injections | simple ads manager | 7.5 (v2.0) | High |
| CVE-2018-7448 | CMS Made Simple 2.1.6 - Remote Code Execution | cms made simple | 7.5 (v3.0) | High |
| CVE-2025-34086 | Bolt CMS 3.7.0 - Authenticated Remote Code Execution | bolt | 7.5 (v4.0) | High |
| CVE-2016-1713 | Vtiger CRM - Authenticated Logo Upload RCE | vtiger crm | 7.3 (v3.0) | High |
| CVE-2018-1000094 | CMS Made Simple Authenticated RCE via File Upload/Copy | cms made simple | 7.2 (v3.0) | High |
| CVE-2020-25042 | MaraCMS Arbitrary PHP File Upload | maracms | 7.2 (v3.1) | High |
| CVE-2020-5792 | Nagios XI 5.5.0-5.7.3 - Snmptrap Authenticated Remote Code Exection | nagios xi | 7.2 (v3.1) | High |
| CVE-2023-28128 | Ivanti Avalanche FileStoreConfig File Upload | avalanche | 7.2 (v3.1) | High |
| CVE-2023-31742 | Linksys WRT54GL Remote Command Execution | wrt54gl firmware | 7.2 (v3.1) | High |
| CVE-2024-25641 | Cacti Import Packages RCE | cacti | 7.2 (v3.1) | High |
| CVE-2025-68109 | ChurchCRM Database Restore RCE 6.2.0 | churchcrm | 7.2 (v3.1) | High |
| CVE-2011-4449 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 6.8 (v2.0) | Medium |
| CVE-2011-4452 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 6.8 (v2.0) | Medium |
| CVE-2015-2995 | SysAid Help Desk 'rdslogs' Arbitrary File Upload | sysaid | 6.8 (v2.0) | Medium |
| CVE-2014-9308 | WordPress WP EasyCart Unrestricted File Upload | wp easycart | 6.5 (v2.0) | Medium |
| CVE-2015-7309 | CMS Bolt File Upload Vulnerability | bolt | 6.5 (v2.0) | Medium |
| CVE-2018-15140 | OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions | openemr | 6.5 (v3.0) | Medium |
| CVE-2018-15141 | OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions | openemr | 6.5 (v3.0) | Medium |
| CVE-2011-4450 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 6.4 (v2.0) | Medium |
| CVE-2014-8598 | MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability | mantisbt | 6.4 (v2.0) | Medium |
| CVE-2023-41425 | WonderCMS Remote Code Execution | wondercms | 6.1 (v3.1) | Medium |
| CVE-2009-4098 | OpenX banner-edit.php File Upload PHP Code Execution | openx | 6.0 (v2.0) | Medium |
| CVE-2011-3833 | Support Incident Tracker Remote Command Execution | support incident tracker | 6.0 (v2.0) | Medium |
| CVE-2014-1610 | MediaWiki Thumb.php Remote Command Execution | mediawiki | 6.0 (v2.0) | Medium |
| CVE-2010-0738 | JBoss Vulnerability Scanner | jboss enterprise application platform | 5.3 (v3.1) | Medium |
| CVE-2019-1622 | Cisco Data Center Network Manager Unauthenticated Remote Code Execution | data center network manager | 5.3 (v3.1) | Medium |
| CVE-2010-4094 | Apache Tomcat Manager Authenticated Upload Code Execution | rational quality manager | 5.0 (v2.0) | Medium |
| CVE-2014-2268 | Vtiger Install Unauthenticated Remote Command Execution | vtiger crm | 5.0 (v2.0) | Medium |
| CVE-2014-6034 | ManageEngine OpManager and Social IT Arbitrary File Upload | manageengine social it plus | 5.0 (v2.0) | Medium |
| CVE-2011-4451 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 4.3 (v2.0) | Medium |
| CVE-2011-3829 | Support Incident Tracker Remote Command Execution | support incident tracker | 4.0 (v2.0) | Medium |
| CVE-2026-90575 | PHPGurukul Small CRM Login Success login.php unserialize deserialization | Small CRM | 2.9 (v4.0) | Low |
| CVE-2025-0655 | D-Tale RCE | - | N/A | N/A |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.