On this page
Atomicorp WAF Rule 380018
Rule Summary
- Rule ID: 380018
- Status: Active
- Alert message: Atomicorp.com WAF Rules: Potentially malicious PHP code injection attempt
- Observed CWEs: CWE-19 (1), CWE-20 (8), CWE-22 (12), CWE-73 (1), CWE-74 (7), CWE-77 (6), CWE-78 (14), CWE-79 (3), CWE-88 (1), CWE-89 (6), CWE-91 (2), CWE-94 (35), CWE-95 (3), CWE-119 (2), CWE-144 (1), CWE-200 (4), CWE-255 (5), CWE-264 (6), CWE-269 (3), CWE-284 (3), CWE-285 (1), CWE-287 (8), CWE-288 (1), CWE-290 (1), CWE-295 (2), CWE-306 (5), CWE-310 (2), CWE-327 (1), CWE-352 (2), CWE-359 (1), CWE-424 (2), CWE-425 (1), CWE-434 (34), CWE-494 (1), CWE-497 (1), CWE-502 (8), CWE-532 (1), CWE-552 (1), CWE-610 (4), CWE-611 (12), CWE-668 (1), CWE-697 (1), CWE-732 (1), CWE-749 (1), CWE-787 (1), CWE-798 (3), CWE-829 (2), CWE-862 (1), CWE-863 (4), CWE-913 (1), CWE-915 (1), CWE-917 (1), CWE-1286 (1), CWE-1321 (1), CWE-1336 (1)
- Revision: 26
- Rule severity: Critical (2)
- Phase: 2 (request body)
- Request surfaces: Request URI, Request arguments, JSON request data, SOAP request data, XML request data
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Potentially malicious PHP code injection attempt” in the request URI, request arguments, JSON request data, SOAP request data, XML request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2009-3843 | Apache Tomcat Manager Authenticated Upload Code Execution | operations manager | 10.0 (v2.0) | High |
| CVE-2009-4188 | Apache Tomcat Manager Authenticated Upload Code Execution | operations dashboard | 10.0 (v2.0) | High |
| CVE-2009-4189 | Apache Tomcat Manager Authenticated Upload Code Execution | operations manager | 10.0 (v2.0) | High |
| CVE-2010-5324 | Novell ZENworks Configuration Management Remote Execution | zenworks configuration management | 10.0 (v2.0) | High |
| CVE-2011-10017 | Snortreport nmap.php/nbtscan.php Remote Command Execution | Snort Report | 10.0 (v4.0) | Critical |
| CVE-2011-10019 | Spreecommerce 0.60.1 Arbitrary Command Execution | spree | 10.0 (v4.0) | Critical |
| CVE-2012-10044 | MobileCartly 1.0 Arbitrary File Creation Vulnerability | MobileCartly | 10.0 (v4.0) | Critical |
| CVE-2012-3260 | HP SiteScope Remote Code Execution | sitescope | 10.0 (v2.0) | High |
| CVE-2012-3261 | HP SiteScope Remote Code Execution | sitescope | 10.0 (v2.0) | High |
| CVE-2013-10040 | ClipBucket Remote Code Execution | clipbucket | 10.0 (v4.0) | Critical |
| CVE-2013-10070 | PHP-Charts v1.0 PHP Code Execution Vulnerability | PHP-Charts | 10.0 (v4.0) | Critical |
| CVE-2013-2751 | NETGEAR ReadyNAS Perl Code Evaluation | raidiator | 10.0 (v2.0) | High |
| CVE-2015-2284 | Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability | firewall security manager | 10.0 (v2.0) | High |
| CVE-2024-25600 | Unauthenticated RCE in Bricks Builder Theme | Bricks Builder | 10.0 (v3.1) | Critical |
| CVE-2025-32432 | Craft CMS Image Transform Preauth RCE (CVE-2025-32432) | craft cms | 10.0 (v3.1) | Critical |
| CVE-2025-49132 | Pterodactyl Panel CVE-2025-49132 Remote Code Execution | panel | 10.0 (v3.1) | Critical |
| CVE-2019-15954 | Total.js CMS 12 Widget JavaScript Code Injection | total.js cms | 9.9 (v3.1) | Critical |
| CVE-2011-3923 | Apache Struts ParametersInterceptor Remote Code Execution | struts | 9.8 (v3.1) | Critical |
| CVE-2012-0911 | Tiki Wiki unserialize() PHP Code Execution | tikiwiki cms/groupware | 9.8 (v3.1) | Critical |
| CVE-2012-6710 | eXtplorer v2.1 Arbitrary File Upload Vulnerability | extplorer | 9.8 (v3.0) | Critical |
| CVE-2013-1359 | SonicWALL GMS 6 Arbitrary File Upload | analyzer | 9.8 (v3.1) | Critical |
| CVE-2013-7390 | ManageEngine Desktop Central AgentLogUpload Arbitrary File Upload | manageengine desktop central | 9.8 (v3.1) | Critical |
| CVE-2014-8684 | Seagate Business NAS Unauthenticated Remote Command Execution | codeigniter | 9.8 (v3.0) | Critical |
| CVE-2014-8686 | Seagate Business NAS Unauthenticated Remote Command Execution | codeigniter | 9.8 (v3.0) | Critical |
| CVE-2014-8687 | Seagate Business NAS Unauthenticated Remote Command Execution | business nas firmware | 9.8 (v3.0) | Critical |
| CVE-2015-2857 | Accellion FTA getStatus verify_oauth_token Command Execution | file transfer appliance | 9.8 (v3.1) | Critical |
| CVE-2015-6922 | Kaseya VSA uploader.aspx Arbitrary File Upload | virtual system administrator | 9.8 (v3.1) | Critical |
| CVE-2015-8249 | ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability | desktop central | 9.8 (v3.0) | Critical |
| CVE-2016-15043 | WordPress WP Mobile Detector 3.5 Shell Upload | wp mobile detector | 9.8 (v3.1) | Critical |
| CVE-2016-3087 | Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution | struts | 9.8 (v3.0) | Critical |
| CVE-2016-3088 | ActiveMQ Arbitrary File Write Vulnerability (CVE-2016-3088) | activemq | 9.8 (v3.1) | Critical |
| CVE-2016-5734 | phpMyAdmin Authenticated Remote Code Execution | phpmyadmin | 9.8 (v3.0) | Critical |
| CVE-2017-12629 | Apache Solr XML External Entity Injection (CVE-2017-12629) | solr | 9.8 (v3.1) | Critical |
| CVE-2017-17560 | Western Digital MyCloud multi_uploadify File Upload Vulnerability | my cloud pr4100 firmware | 9.8 (v3.0) | Critical |
| CVE-2018-14933 | NUUO NVRmini upgrade_handle.php Remote Command Execution | nvrmini firmware | 9.8 (v3.1) | Critical |
| CVE-2018-15708 | Nagios XI Magpie_debug.php Root Remote Code Execution | nagios xi | 9.8 (v3.0) | Critical |
| CVE-2018-6220 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical |
| CVE-2018-6223 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical |
| CVE-2018-6228 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical |
| CVE-2018-6229 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical |
| CVE-2019-11231 | GetSimpleCMS Unauthenticated RCE | getsimple cms | 9.8 (v3.0) | Critical |
| CVE-2019-1619 | Cisco Data Center Network Manager Unauthenticated Remote Code Execution | data center network manager | 9.8 (v3.1) | Critical |
| CVE-2019-1620 | Cisco Data Center Network Manager Unauthenticated Remote Code Execution | data center network manager | 9.8 (v3.1) | Critical |
| CVE-2019-7194 | QNAP QTS and Photo Station Local File Inclusion | photo station | 9.8 (v3.1) | Critical |
| CVE-2020-16152 | Aerohive NetConfig 10.0r8a LFI and log poisoning to RCE | aerohive netconfig | 9.8 (v3.1) | Critical |
| CVE-2020-17496 | vBulletin 5.x /ajax/render/widget_tabbedcontainer_tab_panel PHP remote code execution. | vbulletin | 9.8 (v3.1) | Critical |
| CVE-2020-28188 | TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution | tos | 9.8 (v3.1) | Critical |
| CVE-2020-28871 | Monitorr unauthenticated Remote Code Execution (RCE) | monitorr | 9.8 (v3.1) | Critical |
| CVE-2020-29279 | 74CMS - Remote File Inclusion | 74cms | 9.8 (v3.1) | Critical |
| CVE-2020-35665 | TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution | terramaster operating system | 9.8 (v3.1) | Critical |
| CVE-2020-35846 | Cockpit CMS NoSQLi to RCE | cockpit | 9.8 (v3.1) | Critical |
| CVE-2020-35847 | Cockpit CMS NoSQLi to RCE | cockpit | 9.8 (v3.1) | Critical |
| CVE-2020-36847 | WordPress Simple File List Unauthenticated Remote Code Execution | simple file list | 9.8 (v3.1) | Critical |
| CVE-2020-4427 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.8 (v3.1) | Critical |
| CVE-2020-4429 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.8 (v3.1) | Critical |
| CVE-2020-5847 | Unraid 6.8.0 Auth Bypass PHP Code Execution | unraid | 9.8 (v3.1) | Critical |
| CVE-2020-8518 | Horde CSV import arbitrary PHP code execution | groupware | 9.8 (v3.1) | Critical |
| CVE-2021-1472 | Cisco Small Business RV Series Authentication Bypass and Command Injection | rv160 firmware | 9.8 (v3.1) | Critical |
| CVE-2021-1473 | Cisco Small Business RV Series Authentication Bypass and Command Injection | rv340 firmware | 9.8 (v3.1) | Critical |
| CVE-2022-24637 | Open Web Analytics 1.7.3 - Remote Code Execution (RCE) | open web analytics | 9.8 (v3.1) | Critical |
| CVE-2022-28219 | ManageEngine ADAudit Plus CVE-2022-28219 | manageengine adaudit plus | 9.8 (v3.1) | Critical |
| CVE-2022-31814 | pfSense plugin pfBlockerNG unauthenticated RCE as root | pfblockerng | 9.8 (v3.1) | Critical |
| CVE-2022-35914 | GLPI htmLawed php command injection | glpi | 9.8 (v3.1) | Critical |
| CVE-2022-37061 | FLIR AX8 unauthenticated RCE | flir ax8 firmware | 9.8 (v3.1) | Critical |
| CVE-2022-39952 | Fortinet FortiNAC keyUpload.jsp arbitrary file write | fortinac | 9.8 (v3.1) | Critical |
| CVE-2022-40471 | Clinic's Patient Management System 1.0 - Unauthenticated RCE | clinic's patient management system | 9.8 (v3.1) | Critical |
| CVE-2023-22515 | Atlassian Confluence Unauthenticated Remote Code Execution | confluence data center | 9.8 (v3.1) | Critical |
| CVE-2023-22518 | Atlassian Confluence Unauth JSON setup-restore Improper Authorization leading to RCE (CVE-2023-22518) | confluence data center | 9.8 (v3.1) | Critical |
| CVE-2023-23333 | SolarView Compact unauthenticated remote command execution vulnerability. | solarview compact firmware | 9.8 (v3.1) | Critical |
| CVE-2023-26068 | Lexmark Device Embedded Web Server RCE | cxtpc firmware | 9.8 (v3.1) | Critical |
| CVE-2023-3519 | Citrix ADC (NetScaler) Forms SSO Target RCE | netscaler application delivery controller | 9.8 (v3.1) | Critical |
| CVE-2024-0204 | Fortra GoAnywhere MFT Unauthenticated Remote Code Execution | goanywhere managed file transfer | 9.8 (v3.1) | Critical |
| CVE-2024-11680 | ProjectSend r1295 - r1605 Unauthenticated Remote Code Execution | projectsend | 9.8 (v3.1) | Critical |
| CVE-2024-2054 | Artica Proxy Unauthenticated PHP Deserialization Vulnerability | artica proxy | 9.8 (v3.1) | Critical |
| CVE-2024-23759 | Gambio Online Webshop unauthenticated PHP Deserialization Vulnerability | gambio | 9.8 (v3.1) | Critical |
| CVE-2024-27198 | JetBrains TeamCity Unauthenticated Remote Code Execution | teamcity | 9.8 (v3.1) | Critical |
| CVE-2024-3116 | pgAdmin Binary Path API RCE | pgadmin 4 | 9.8 (v3.1) | Critical |
| CVE-2024-3408 | D-Tale RCE | d-tale | 9.8 (v3.1) | Critical |
| CVE-2024-34102 | CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961) | commerce | 9.8 (v3.1) | Critical |
| CVE-2024-39205 | Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397) | - | 9.8 (v3.1) | Critical |
| CVE-2024-4358 | Telerik Report Server Auth Bypass and Deserialization RCE | report server 2024 | 9.8 (v3.1) | Critical |
| CVE-2024-6782 | Calibre Python Code Injection (CVE-2024-6782) | Calibre | 9.8 (v3.1) | Critical |
| CVE-2024-7954 | SPIP Unauthenticated RCE via porte_plume Plugin | SPIP | 9.8 (v3.1) | Critical |
| CVE-2025-11749 | WordPress AI Engine Plugin MCP Unauthenticated Admin Creation to RCE | AI Engine – The Chatbot, AI Framework & MCP for WordPress | 9.8 (v3.1) | Critical |
| CVE-2025-48827 | vBulletin replaceAdTemplate Remote Code Execution | vbulletin | 9.8 (v3.1) | Critical |
| CVE-2025-7441 | WordPress StoryChief Plugin Unauthenticated RCE | StoryChief | 9.8 (v3.1) | Critical |
| CVE-2026-77806 | SPIP < 4.4.22 - Unauthenticated RCE | SPIP | 9.8 (v3.1) | Critical |
| CVE-2025-34074 | Lucee Authenticated Scheduled Job Code Execution | Lucee | 9.4 (v4.0) | Critical |
| CVE-2025-34104 | Piwik Superuser Plugin Upload | Web Analytics Platform | 9.4 (v4.0) | Critical |
| CVE-2026-19626 | Tenable Security Center Report Charting RCE | security center | 9.4 (v4.0) | Critical |
| CVE-2026-19681 | Tenable Security Center SCAP Audit File Command Injection | security center | 9.4 (v4.0) | Critical |
| CVE-2009-20006 | osCommerce 2.2 Arbitrary PHP Code Execution | osCommerce | 9.3 (v4.0) | Critical |
| CVE-2009-3068 | Adobe RoboHelp Server 8 Arbitrary File Upload and Execute | robohelp server | 9.3 (v2.0) | High |
| CVE-2011-10026 | Spreecommerce Arbitrary Command Execution | spree | 9.3 (v4.0) | Critical |
| CVE-2013-10034 | Kaseya uploadImage Arbitrary File Upload | KServer | 9.3 (v4.0) | Critical |
| CVE-2013-10054 | LibrettoCMS File Manager Arbitary File Upload Vulnerability | LibrettoCMS | 9.3 (v4.0) | Critical |
| CVE-2014-125113 | Dell KACE K1000 File Upload | KACE K1000 Systems Management Appliance | 9.3 (v4.0) | Critical |
| CVE-2016-15044 | Kaltura Remote PHP Code Execution | Video Platform | 9.3 (v4.0) | Critical |
| CVE-2025-25034 | SugarCRM REST Unserialize PHP Code Execution | SugarCRM | 9.3 (v4.0) | Critical |
| CVE-2025-34121 | Idera Up.Time Monitoring Station 7.0 post2file.php Arbitrary File Upload | Up.Time Monitoring Station | 9.3 (v4.0) | Critical |
| CVE-2025-34433 | AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery | AVideo | 9.3 (v4.0) | Critical |
| CVE-2025-71243 | SPIP Saisies Plugin Unauthenticated RCE | saisies | 9.3 (v4.0) | Critical |
| CVE-2026-27174 | MajorDoMo Console Eval Unauthenticated RCE | majordomo | 9.3 (v4.0) | Critical |
| CVE-2026-27760 | OpenCATS Installer PHP Code Injection | OpenCATS | 9.2 (v4.0) | Critical |
| CVE-2014-7236 | TWiki Debugenableplugins Remote Code Execution | twiki | 9.1 (v3.1) | Critical |
| CVE-2020-24589 | WSO2 API Manager <=3.1.0 - Blind XML External Entity Injection | api manager | 9.1 (v3.1) | Critical |
| CVE-2020-4428 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.1 (v3.1) | Critical |
| CVE-2010-1871 | JBoss Seam 2 File Upload and Execute | jboss enterprise application platform | 8.8 (v3.1) | High |
| CVE-2015-6000 | Vtiger CRM - Authenticated Logo Upload RCE | vtiger crm | 8.8 (v3.1) | High |
| CVE-2017-16524 | Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload | web viewer | 8.8 (v3.0) | High |
| CVE-2017-16666 | Xplico Remote Code Execution | xplico | 8.8 (v3.0) | High |
| CVE-2017-6090 | phpCollab 2.5.1 Unauthenticated File Upload | phpcollab | 8.8 (v3.0) | High |
| CVE-2017-7411 | Tuleap 9.6 Second-Order PHP Object Injection | tuleap | 8.8 (v3.0) | High |
| CVE-2018-6224 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 8.8 (v3.0) | High |
| CVE-2019-10267 | Ahsay Backup v7.x-v8.1.1.50 (authenticated) file upload | cloud backup suite | 8.8 (v3.0) | High |
| CVE-2019-9055 | CMS Made Simple Authenticated RCE via object injection | cms made simple | 8.8 (v3.0) | High |
| CVE-2020-14321 | Moodle Teacher Enrollment Privilege Escalation to RCE | moodle | 8.8 (v3.1) | High |
| CVE-2020-27386 | FlexDotnetCMS Arbitrary ASP File Upload | flexdotnetcms | 8.8 (v3.1) | High |
| CVE-2020-27387 | HorizontCMS Arbitrary PHP File Upload | horizontcms | 8.8 (v3.1) | High |
| CVE-2021-37343 | Nagios XI Autodiscovery Webshell Upload | nagios xi | 8.8 (v3.1) | High |
| CVE-2021-41282 | pfSense Diag Routes Web Shell Upload | pfsense | 8.8 (v3.1) | High |
| CVE-2021-43258 | ChurchInfo 1.2.13-1.3.0 Authenticated RCE | churchinfo | 8.8 (v3.1) | High |
| CVE-2022-0824 | Webmin File Manager RCE | webmin | 8.8 (v3.1) | High |
| CVE-2022-3405 | Acronis Cyber Protect/Backup machine info disclosure | cyber backup | 8.8 (v3.1) | High |
| CVE-2023-22952 | SugarCRM unauthenticated Remote Code Execution (RCE) | sugarcrm | 8.8 (v3.1) | High |
| CVE-2023-32707 | Splunk "edit_user" Capability Privilege Escalation | splunk | 8.8 (v3.1) | High |
| CVE-2023-38836 | BoidCMS Command Injection | boidcms | 8.8 (v3.1) | High |
| CVE-2023-46214 | Splunk Authenticated XSLT Upload RCE | cloud | 8.8 (v3.1) | High |
| CVE-2024-1800 | Telerik Report Server Auth Bypass and Deserialization RCE | telerik report server | 8.8 (v3.1) | High |
| CVE-2024-21683 | Atlassian Confluence Administrator Code Macro Remote Code Execution | confluence data center | 8.8 (v3.1) | High |
| CVE-2025-34511 | Sitecore XP CVE-2025-34511 Post-Authentication File Upload | experience commerce | 8.8 (v3.1) | High |
| CVE-2025-49113 | Roundcube Post-Auth RCE via PHP Object Deserialization | webmail | 8.8 (v3.1) | High |
| CVE-2025-68613 | n8n Workflow Expression Remote Code Execution | n8n | 8.8 (v3.1) | High |
| CVE-2025-24367 | Cacti Graph Template authenticated RCE versions prior to 1.2.29 | cacti | 8.7 (v4.0) | High |
| CVE-2015-8279 | Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload | web viewer | 8.6 (v3.0) | High |
| CVE-2025-49619 | Skyvern SSTI Remote Code Execution | Skyvern | 8.5 (v3.1) | High |
| CVE-2016-3081 | Apache Struts Dynamic Method Invocation Remote Code Execution | agile controller-campus firmware | 8.1 (v3.1) | High |
| CVE-2017-12615 | Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1) | tomcat | 8.1 (v3.1) | High |
| CVE-2018-6221 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 8.1 (v3.0) | High |
| CVE-2025-2563 | WP User Registration and Membership Unauthenticated Privilege Escalation (CVE-2025-2563) | user registration & membership | 8.1 (v3.1) | High |
| CVE-2025-48828 | vBulletin replaceAdTemplate Remote Code Execution | vbulletin | 8.1 (v3.1) | High |
| CVE-2018-15710 | Nagios XI Magpie_debug.php Root Remote Code Execution | nagios xi | 7.8 (v3.0) | High |
| CVE-2018-6222 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 7.8 (v3.0) | High |
| CVE-2019-9624 | Webmin Upload Authenticated RCE | webmin | 7.8 (v3.0) | High |
| CVE-2016-3473 | Oracle BI Publisher 11.1.1.6.0/11.1.1.7.0/11.1.1.9.0/12.2.1.0.0 - XML External Entity Injection | business intelligence publisher | 7.7 (v3.0) | High |
| CVE-2026-54640 | OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory | openremote | 7.6 (v3.1) | High |
| CVE-2003-0050 | QuickTime Streaming Server parse_xml.cgi Remote Execution | darwin streaming server | 7.5 (v2.0) | High |
| CVE-2005-2733 | Simple PHP Blog Remote Command Execution | simple php blog | 7.5 (v2.0) | High |
| CVE-2007-1036 | JBoss JMX Console Deployer Upload and Execute | jboss application server | 7.5 (v2.0) | High |
| CVE-2008-6508 | Openfire Admin Console Authentication Bypass | openfire | 7.5 (v2.0) | High |
| CVE-2009-3548 | Apache Tomcat Manager Authenticated Upload Code Execution | tomcat | 7.5 (v2.0) | High |
| CVE-2009-4140 | OpenEMR PHP File Upload Vulnerability | open flash chart | 7.5 (v2.0) | High |
| CVE-2010-0557 | Apache Tomcat Manager Authenticated Upload Code Execution | cognos express | 7.5 (v2.0) | High |
| CVE-2010-4417 | Oracle BeeHive 2 voice-servlet processEvaluation() Vulnerability | beehive | 7.5 (v2.0) | High |
| CVE-2011-4453 | PmWiki pagelist.php Remote PHP Code Injection Exploit | pmwiki | 7.5 (v2.0) | High |
| CVE-2012-6329 | TWiki MAKETEXT Remote Command Execution | perl | 7.5 (v2.0) | High |
| CVE-2013-0209 | Movable Type 4.2x, 4.3x Web Upgrade Remote Code Execution | movable type | 7.5 (v2.0) | High |
| CVE-2013-1081 | Novell Zenworks Mobile Managment MDM.php Local File Inclusion Vulnerability | zenworks mobile management | 7.5 (v2.0) | High |
| CVE-2013-1349 | OpenSIS 'modname' PHP Code Execution | opensis | 7.5 (v2.0) | High |
| CVE-2013-1412 | DataLife Engine preview.php PHP Code Injection | datalife engine | 7.5 (v2.0) | High |
| CVE-2013-4557 | SPIP connect Parameter PHP Injection | spip | 7.5 (v2.0) | High |
| CVE-2013-5036 | Squash YAML Code Execution | square squash | 7.5 (v2.0) | High |
| CVE-2014-1691 | Horde Framework Unserialize PHP Code Execution | horde application framework | 7.5 (v2.0) | High |
| CVE-2014-3704 | Drupal < 7.32 "Drupalgeddon" SQL Injection (CVE-2014-3704) | drupal | 7.5 (v2.0) | High |
| CVE-2014-5005 | ManageEngine Desktop Central StatusUpdate Arbitrary File Upload | manageengine desktop central | 7.5 (v2.0) | High |
| CVE-2014-6389 | PHPCompta/NOALYSS 6.7.1 5638 - Remote Command Execution | phpcompta/noalyss | 7.5 (v2.0) | High |
| CVE-2014-6446 | Wordpress InfusionSoft Upload Vulnerability | infusionsoft gravity forms | 7.5 (v2.0) | High |
| CVE-2014-7146 | MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability | mantisbt | 7.5 (v2.0) | High |
| CVE-2014-9567 | ProjectSend Arbitrary File Upload | projectsend | 7.5 (v2.0) | High |
| CVE-2015-2208 | PHPMoAdmin 1.1.2 Remote Code Execution | phpmoadmin | 7.5 (v2.0) | High |
| CVE-2019-9757 | LabKey Server 19.1.0 - XML External Entity (XXE) | labkey server | 7.5 (v3.1) | High |
| CVE-2020-5849 | Unraid 6.8.0 Auth Bypass PHP Code Execution | unraid | 7.5 (v3.1) | High |
| CVE-2022-30995 | Acronis Cyber Protect/Backup machine info disclosure | cyber backup | 7.5 (v3.1) | High |
| CVE-2022-38840 | Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE) | man-eam-0003 | 7.5 (v3.1) | High |
| CVE-2025-34086 | Bolt CMS 3.7.0 - Authenticated Remote Code Execution | bolt | 7.5 (v4.0) | High |
| CVE-2016-1713 | Vtiger CRM - Authenticated Logo Upload RCE | vtiger crm | 7.3 (v3.0) | High |
| CVE-2016-2098 | Ruby on Rails ActionPack Inline ERB Code Execution | debian linux | 7.3 (v3.0) | High |
| CVE-2024-2961 | CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961) | glibc | 7.3 (v3.1) | High |
| CVE-2018-1000094 | CMS Made Simple Authenticated RCE via File Upload/Copy | cms made simple | 7.2 (v3.0) | High |
| CVE-2019-2767 | Oracle Business Intelligence Publisher - XML External Entity Injection | bi publisher | 7.2 (v3.0) | High |
| CVE-2020-25042 | MaraCMS Arbitrary PHP File Upload | maracms | 7.2 (v3.1) | High |
| CVE-2020-5792 | Nagios XI 5.5.0-5.7.3 - Snmptrap Authenticated Remote Code Exection | nagios xi | 7.2 (v3.1) | High |
| CVE-2022-3552 | BoxBilling<=4.22.1.5 - Remote Code Execution (RCE) | boxbilling | 7.2 (v3.1) | High |
| CVE-2023-28128 | Ivanti Avalanche FileStoreConfig File Upload | avalanche | 7.2 (v3.1) | High |
| CVE-2023-31742 | Linksys WRT54GL Remote Command Execution | wrt54gl firmware | 7.2 (v3.1) | High |
| CVE-2024-25641 | Cacti Import Packages RCE | cacti | 7.2 (v3.1) | High |
| CVE-2025-68109 | ChurchCRM Database Restore RCE 6.2.0 | churchcrm | 7.2 (v3.1) | High |
| CVE-2025-34441 | AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery | avideo | 6.9 (v4.0) | Medium |
| CVE-2025-34442 | AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery | avideo | 6.9 (v4.0) | Medium |
| CVE-2008-6132 | phpScheduleIt PHP reserve.php start_date Parameter Arbitrary Code Injection | phpscheduleit | 6.8 (v2.0) | Medium |
| CVE-2008-6825 | Trixbox langChoice PHP Local File Inclusion | trixbox | 6.8 (v2.0) | Medium |
| CVE-2015-2995 | SysAid Help Desk 'rdslogs' Arbitrary File Upload | sysaid | 6.8 (v2.0) | Medium |
| CVE-2018-6230 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 6.8 (v3.0) | Medium |
| CVE-2014-8998 | X7 Chat 2.0.5 lib/message.php preg_replace() PHP Code Execution | x7 chat | 6.5 (v2.0) | Medium |
| CVE-2014-9308 | WordPress WP EasyCart Unrestricted File Upload | wp easycart | 6.5 (v2.0) | Medium |
| CVE-2015-7309 | CMS Bolt File Upload Vulnerability | bolt | 6.5 (v2.0) | Medium |
| CVE-2018-6219 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 6.5 (v3.0) | Medium |
| CVE-2014-8598 | MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability | mantisbt | 6.4 (v2.0) | Medium |
| CVE-2023-41425 | WonderCMS Remote Code Execution | wondercms | 6.1 (v3.1) | Medium |
| CVE-2011-3833 | Support Incident Tracker Remote Command Execution | support incident tracker | 6.0 (v2.0) | Medium |
| CVE-2013-2121 | Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection | openstack | 6.0 (v2.0) | Medium |
| CVE-2013-3238 | phpMyAdmin Authenticated Remote Code Execution via preg_replace() | phpmyadmin | 6.0 (v2.0) | Medium |
| CVE-2014-1610 | MediaWiki Thumb.php Remote Command Execution | mediawiki | 6.0 (v2.0) | Medium |
| CVE-2025-10091 | Jinher OA XML Type xml external entity reference | jinher oa | 5.5 (v4.0) | Medium |
| CVE-2025-10816 | Jinher OA XML text xml external entity reference | jinher oa | 5.5 (v4.0) | Medium |
| CVE-2018-6226 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 5.4 (v3.0) | Medium |
| CVE-2018-6227 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 5.4 (v3.0) | Medium |
| CVE-2010-0738 | JBoss Vulnerability Scanner | jboss enterprise application platform | 5.3 (v3.1) | Medium |
| CVE-2019-1622 | Cisco Data Center Network Manager Unauthenticated Remote Code Execution | data center network manager | 5.3 (v3.1) | Medium |
| CVE-2024-28397 | Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397) | pyload | 5.3 (v3.1) | Medium |
| CVE-2026-89247 | WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2011-0518 | LotusCMS 3.0 eval() Remote Command Execution | fraise | 5.1 (v2.0) | Medium |
| CVE-2010-4094 | Apache Tomcat Manager Authenticated Upload Code Execution | rational quality manager | 5.0 (v2.0) | Medium |
| CVE-2014-6034 | ManageEngine OpManager and Social IT Arbitrary File Upload | manageengine social it plus | 5.0 (v2.0) | Medium |
| CVE-2015-0922 | McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure | epolicy orchestrator | 5.0 (v2.0) | Medium |
| CVE-2011-4642 | Splunk Search Remote Code Execution | splunk | 4.6 (v2.0) | Medium |
| CVE-2018-6225 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 4.3 (v3.0) | Medium |
| CVE-2011-3829 | Support Incident Tracker Remote Command Execution | support incident tracker | 4.0 (v2.0) | Medium |
| CVE-2015-0921 | McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure | epolicy orchestrator | 4.0 (v2.0) | Medium |
| CVE-2025-11035 | Jinher OA text xml external entity reference | jinher oa | 2.1 (v4.0) | Low |
| CVE-2025-13209 | bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference | oa git free | 2.1 (v4.0) | Low |
| CVE-2025-14730 | CTCMS Content Management System Backend System Configuration Ct_Config.php code injection | ctcms | 2.0 (v4.0) | Low |
| CVE-2012-6315 | Movable Type 4.2x, 4.3x Web Upgrade Remote Code Execution | - | N/A | N/A |
| CVE-2025-0655 | D-Tale RCE | - | N/A | N/A |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.