On this page
Atomicorp WAF Rule 390801
Rule Summary
- Rule ID: 390801
- Status: Active
- Alert message: Atomicorp.com WAF Rules: Possible Shellkit attack: Generic Attempt to insert shell code
- Observed CWEs: CWE-19 (1), CWE-20 (8), CWE-22 (12), CWE-73 (1), CWE-74 (6), CWE-77 (6), CWE-78 (13), CWE-79 (2), CWE-88 (1), CWE-89 (3), CWE-91 (1), CWE-94 (40), CWE-95 (4), CWE-119 (2), CWE-144 (1), CWE-178 (1), CWE-200 (2), CWE-255 (5), CWE-264 (6), CWE-269 (3), CWE-284 (3), CWE-285 (1), CWE-287 (9), CWE-288 (2), CWE-290 (1), CWE-306 (7), CWE-310 (2), CWE-327 (1), CWE-352 (1), CWE-359 (1), CWE-424 (2), CWE-425 (1), CWE-434 (36), CWE-494 (1), CWE-497 (1), CWE-502 (9), CWE-532 (1), CWE-552 (1), CWE-668 (1), CWE-697 (1), CWE-732 (1), CWE-749 (1), CWE-798 (3), CWE-829 (2), CWE-862 (1), CWE-863 (4), CWE-913 (1), CWE-915 (1), CWE-917 (1), CWE-1286 (1), CWE-1321 (1), CWE-1336 (1)
- Revision: 5
- Rule severity: Critical (2)
- Request surfaces: Request URI, Request arguments, JSON request data, SOAP request data
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Possible Shellkit attack: Generic Attempt to insert shell code” in the request URI, request arguments, JSON request data, SOAP request data. denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2009-3843 | Apache Tomcat Manager Authenticated Upload Code Execution | operations manager | 10.0 (v2.0) | High |
| CVE-2009-4188 | Apache Tomcat Manager Authenticated Upload Code Execution | operations dashboard | 10.0 (v2.0) | High |
| CVE-2009-4189 | Apache Tomcat Manager Authenticated Upload Code Execution | operations manager | 10.0 (v2.0) | High |
| CVE-2010-5324 | Novell ZENworks Configuration Management Remote Execution | zenworks configuration management | 10.0 (v2.0) | High |
| CVE-2011-10017 | Snortreport nmap.php/nbtscan.php Remote Command Execution | Snort Report | 10.0 (v4.0) | Critical |
| CVE-2011-10019 | Spreecommerce 0.60.1 Arbitrary Command Execution | spree | 10.0 (v4.0) | Critical |
| CVE-2012-10044 | MobileCartly 1.0 Arbitrary File Creation Vulnerability | MobileCartly | 10.0 (v4.0) | Critical |
| CVE-2012-3260 | HP SiteScope Remote Code Execution | sitescope | 10.0 (v2.0) | High |
| CVE-2012-3261 | HP SiteScope Remote Code Execution | sitescope | 10.0 (v2.0) | High |
| CVE-2013-10040 | ClipBucket Remote Code Execution | clipbucket | 10.0 (v4.0) | Critical |
| CVE-2013-10070 | PHP-Charts v1.0 PHP Code Execution Vulnerability | PHP-Charts | 10.0 (v4.0) | Critical |
| CVE-2013-2751 | NETGEAR ReadyNAS Perl Code Evaluation | raidiator | 10.0 (v2.0) | High |
| CVE-2015-2284 | Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability | firewall security manager | 10.0 (v2.0) | High |
| CVE-2024-25600 | Unauthenticated RCE in Bricks Builder Theme | Bricks Builder | 10.0 (v3.1) | Critical |
| CVE-2025-32432 | Craft CMS Image Transform Preauth RCE (CVE-2025-32432) | craft cms | 10.0 (v3.1) | Critical |
| CVE-2019-15954 | Total.js CMS 12 Widget JavaScript Code Injection | total.js cms | 9.9 (v3.1) | Critical |
| CVE-2011-3923 | Apache Struts ParametersInterceptor Remote Code Execution | struts | 9.8 (v3.1) | Critical |
| CVE-2012-0911 | Tiki Wiki unserialize() PHP Code Execution | tikiwiki cms/groupware | 9.8 (v3.1) | Critical |
| CVE-2012-6710 | eXtplorer v2.1 Arbitrary File Upload Vulnerability | extplorer | 9.8 (v3.0) | Critical |
| CVE-2013-1359 | SonicWALL GMS 6 Arbitrary File Upload | analyzer | 9.8 (v3.1) | Critical |
| CVE-2013-7390 | ManageEngine Desktop Central AgentLogUpload Arbitrary File Upload | manageengine desktop central | 9.8 (v3.1) | Critical |
| CVE-2014-8684 | Seagate Business NAS Unauthenticated Remote Command Execution | codeigniter | 9.8 (v3.0) | Critical |
| CVE-2014-8686 | Seagate Business NAS Unauthenticated Remote Command Execution | codeigniter | 9.8 (v3.0) | Critical |
| CVE-2014-8687 | Seagate Business NAS Unauthenticated Remote Command Execution | business nas firmware | 9.8 (v3.0) | Critical |
| CVE-2015-2857 | Accellion FTA getStatus verify_oauth_token Command Execution | file transfer appliance | 9.8 (v3.1) | Critical |
| CVE-2015-6922 | Kaseya VSA uploader.aspx Arbitrary File Upload | virtual system administrator | 9.8 (v3.1) | Critical |
| CVE-2015-8249 | ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability | desktop central | 9.8 (v3.0) | Critical |
| CVE-2016-15043 | WordPress WP Mobile Detector 3.5 Shell Upload | wp mobile detector | 9.8 (v3.1) | Critical |
| CVE-2016-3087 | Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution | struts | 9.8 (v3.0) | Critical |
| CVE-2016-3088 | ActiveMQ Arbitrary File Write Vulnerability (CVE-2016-3088) | activemq | 9.8 (v3.1) | Critical |
| CVE-2016-5734 | phpMyAdmin Authenticated Remote Code Execution | phpmyadmin | 9.8 (v3.0) | Critical |
| CVE-2017-17560 | Western Digital MyCloud multi_uploadify File Upload Vulnerability | my cloud pr4100 firmware | 9.8 (v3.0) | Critical |
| CVE-2018-14933 | NUUO NVRmini upgrade_handle.php Remote Command Execution | nvrmini firmware | 9.8 (v3.1) | Critical |
| CVE-2018-15708 | Nagios XI Magpie_debug.php Root Remote Code Execution | nagios xi | 9.8 (v3.0) | Critical |
| CVE-2019-11231 | GetSimpleCMS Unauthenticated RCE | getsimple cms | 9.8 (v3.0) | Critical |
| CVE-2019-1619 | Cisco Data Center Network Manager Unauthenticated Remote Code Execution | data center network manager | 9.8 (v3.1) | Critical |
| CVE-2019-1620 | Cisco Data Center Network Manager Unauthenticated Remote Code Execution | data center network manager | 9.8 (v3.1) | Critical |
| CVE-2019-7194 | QNAP QTS and Photo Station Local File Inclusion | photo station | 9.8 (v3.1) | Critical |
| CVE-2020-16152 | Aerohive NetConfig 10.0r8a LFI and log poisoning to RCE | aerohive netconfig | 9.8 (v3.1) | Critical |
| CVE-2020-17496 | vBulletin 5.x /ajax/render/widget_tabbedcontainer_tab_panel PHP remote code execution. | vbulletin | 9.8 (v3.1) | Critical |
| CVE-2020-28188 | TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution | tos | 9.8 (v3.1) | Critical |
| CVE-2020-28871 | Monitorr unauthenticated Remote Code Execution (RCE) | monitorr | 9.8 (v3.1) | Critical |
| CVE-2020-35665 | TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution | terramaster operating system | 9.8 (v3.1) | Critical |
| CVE-2020-35846 | Cockpit CMS NoSQLi to RCE | cockpit | 9.8 (v3.1) | Critical |
| CVE-2020-35847 | Cockpit CMS NoSQLi to RCE | cockpit | 9.8 (v3.1) | Critical |
| CVE-2020-36847 | WordPress Simple File List Unauthenticated Remote Code Execution | simple file list | 9.8 (v3.1) | Critical |
| CVE-2020-4427 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.8 (v3.1) | Critical |
| CVE-2020-4429 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.8 (v3.1) | Critical |
| CVE-2020-5847 | Unraid 6.8.0 Auth Bypass PHP Code Execution | unraid | 9.8 (v3.1) | Critical |
| CVE-2020-8518 | Horde CSV import arbitrary PHP code execution | groupware | 9.8 (v3.1) | Critical |
| CVE-2021-1472 | Cisco Small Business RV Series Authentication Bypass and Command Injection | rv160 firmware | 9.8 (v3.1) | Critical |
| CVE-2021-1473 | Cisco Small Business RV Series Authentication Bypass and Command Injection | rv340 firmware | 9.8 (v3.1) | Critical |
| CVE-2022-24637 | Open Web Analytics 1.7.3 - Remote Code Execution (RCE) | open web analytics | 9.8 (v3.1) | Critical |
| CVE-2022-31814 | pfSense plugin pfBlockerNG unauthenticated RCE as root | pfblockerng | 9.8 (v3.1) | Critical |
| CVE-2022-35914 | GLPI htmLawed php command injection | glpi | 9.8 (v3.1) | Critical |
| CVE-2022-37061 | FLIR AX8 unauthenticated RCE | flir ax8 firmware | 9.8 (v3.1) | Critical |
| CVE-2022-39952 | Fortinet FortiNAC keyUpload.jsp arbitrary file write | fortinac | 9.8 (v3.1) | Critical |
| CVE-2022-40471 | Clinic's Patient Management System 1.0 - Unauthenticated RCE | clinic's patient management system | 9.8 (v3.1) | Critical |
| CVE-2023-22515 | Atlassian Confluence Unauthenticated Remote Code Execution | confluence data center | 9.8 (v3.1) | Critical |
| CVE-2023-22518 | Atlassian Confluence Unauth JSON setup-restore Improper Authorization leading to RCE (CVE-2023-22518) | confluence data center | 9.8 (v3.1) | Critical |
| CVE-2023-23333 | SolarView Compact unauthenticated remote command execution vulnerability. | solarview compact firmware | 9.8 (v3.1) | Critical |
| CVE-2023-26068 | Lexmark Device Embedded Web Server RCE | cxtpc firmware | 9.8 (v3.1) | Critical |
| CVE-2023-3519 | Citrix ADC (NetScaler) Forms SSO Target RCE | netscaler application delivery controller | 9.8 (v3.1) | Critical |
| CVE-2024-0204 | Fortra GoAnywhere MFT Unauthenticated Remote Code Execution | goanywhere managed file transfer | 9.8 (v3.1) | Critical |
| CVE-2024-10924 | WordPress Really Simple SSL Plugin Authentication Bypass to RCE | really simple security | 9.8 (v3.1) | Critical |
| CVE-2024-11680 | ProjectSend r1295 - r1605 Unauthenticated Remote Code Execution | projectsend | 9.8 (v3.1) | Critical |
| CVE-2024-2054 | Artica Proxy Unauthenticated PHP Deserialization Vulnerability | artica proxy | 9.8 (v3.1) | Critical |
| CVE-2024-23759 | Gambio Online Webshop unauthenticated PHP Deserialization Vulnerability | gambio | 9.8 (v3.1) | Critical |
| CVE-2024-27198 | JetBrains TeamCity Unauthenticated Remote Code Execution | teamcity | 9.8 (v3.1) | Critical |
| CVE-2024-3116 | pgAdmin Binary Path API RCE | pgadmin 4 | 9.8 (v3.1) | Critical |
| CVE-2024-3408 | D-Tale RCE | d-tale | 9.8 (v3.1) | Critical |
| CVE-2024-39205 | Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397) | - | 9.8 (v3.1) | Critical |
| CVE-2024-4358 | Telerik Report Server Auth Bypass and Deserialization RCE | report server 2024 | 9.8 (v3.1) | Critical |
| CVE-2024-6782 | Calibre Python Code Injection (CVE-2024-6782) | Calibre | 9.8 (v3.1) | Critical |
| CVE-2024-7954 | SPIP Unauthenticated RCE via porte_plume Plugin | SPIP | 9.8 (v3.1) | Critical |
| CVE-2025-11749 | WordPress AI Engine Plugin MCP Unauthenticated Admin Creation to RCE | AI Engine – The Chatbot, AI Framework & MCP for WordPress | 9.8 (v3.1) | Critical |
| CVE-2025-47916 | Invision Community 5.0.6 customCss RCE | invisioncommunity | 9.8 (v3.1) | Critical |
| CVE-2025-48827 | vBulletin replaceAdTemplate Remote Code Execution | vbulletin | 9.8 (v3.1) | Critical |
| CVE-2025-7441 | WordPress StoryChief Plugin Unauthenticated RCE | StoryChief | 9.8 (v3.1) | Critical |
| CVE-2025-34074 | Lucee Authenticated Scheduled Job Code Execution | Lucee | 9.4 (v4.0) | Critical |
| CVE-2025-34104 | Piwik Superuser Plugin Upload | Web Analytics Platform | 9.4 (v4.0) | Critical |
| CVE-2026-19626 | Tenable Security Center Report Charting RCE | security center | 9.4 (v4.0) | Critical |
| CVE-2026-19681 | Tenable Security Center SCAP Audit File Command Injection | security center | 9.4 (v4.0) | Critical |
| CVE-2009-20006 | osCommerce 2.2 Arbitrary PHP Code Execution | osCommerce | 9.3 (v4.0) | Critical |
| CVE-2009-3068 | Adobe RoboHelp Server 8 Arbitrary File Upload and Execute | robohelp server | 9.3 (v2.0) | High |
| CVE-2011-10026 | Spreecommerce Arbitrary Command Execution | spree | 9.3 (v4.0) | Critical |
| CVE-2013-10034 | Kaseya uploadImage Arbitrary File Upload | KServer | 9.3 (v4.0) | Critical |
| CVE-2013-10051 | InstantCMS 1.6 Remote PHP Code Execution | instantcms | 9.3 (v4.0) | Critical |
| CVE-2013-10054 | LibrettoCMS File Manager Arbitary File Upload Vulnerability | LibrettoCMS | 9.3 (v4.0) | Critical |
| CVE-2014-125113 | Dell KACE K1000 File Upload | KACE K1000 Systems Management Appliance | 9.3 (v4.0) | Critical |
| CVE-2014-125116 | HybridAuth install.php PHP Code Execution | HybridAuth | 9.3 (v4.0) | Critical |
| CVE-2016-15044 | Kaltura Remote PHP Code Execution | Video Platform | 9.3 (v4.0) | Critical |
| CVE-2025-25034 | SugarCRM REST Unserialize PHP Code Execution | SugarCRM | 9.3 (v4.0) | Critical |
| CVE-2025-34121 | Idera Up.Time Monitoring Station 7.0 post2file.php Arbitrary File Upload | Up.Time Monitoring Station | 9.3 (v4.0) | Critical |
| CVE-2025-34433 | AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery | AVideo | 9.3 (v4.0) | Critical |
| CVE-2025-71243 | SPIP Saisies Plugin Unauthenticated RCE | saisies | 9.3 (v4.0) | Critical |
| CVE-2026-27174 | MajorDoMo Console Eval Unauthenticated RCE | majordomo | 9.3 (v4.0) | Critical |
| CVE-2026-27760 | OpenCATS Installer PHP Code Injection | OpenCATS | 9.2 (v4.0) | Critical |
| CVE-2014-7236 | TWiki Debugenableplugins Remote Code Execution | twiki | 9.1 (v3.1) | Critical |
| CVE-2020-4428 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.1 (v3.1) | Critical |
| CVE-2025-54236 | Magento SessionReaper | commerce | 9.1 (v3.1) | Critical |
| CVE-2008-4687 | Mantis manage_proj_page PHP Code Execution | mantis | 9.0 (v2.0) | High |
| CVE-2010-1871 | JBoss Seam 2 File Upload and Execute | jboss enterprise application platform | 8.8 (v3.1) | High |
| CVE-2015-6000 | Vtiger CRM - Authenticated Logo Upload RCE | vtiger crm | 8.8 (v3.1) | High |
| CVE-2017-16524 | Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload | web viewer | 8.8 (v3.0) | High |
| CVE-2017-16666 | Xplico Remote Code Execution | xplico | 8.8 (v3.0) | High |
| CVE-2017-6090 | phpCollab 2.5.1 Unauthenticated File Upload | phpcollab | 8.8 (v3.0) | High |
| CVE-2017-7411 | Tuleap 9.6 Second-Order PHP Object Injection | tuleap | 8.8 (v3.0) | High |
| CVE-2018-12613 | phpMyAdmin Authenticated Remote Code Execution | phpmyadmin | 8.8 (v3.1) | High |
| CVE-2019-10267 | Ahsay Backup v7.x-v8.1.1.50 (authenticated) file upload | cloud backup suite | 8.8 (v3.0) | High |
| CVE-2019-10867 | Pimcore Unserialize RCE | pimcore | 8.8 (v3.0) | High |
| CVE-2019-9055 | CMS Made Simple Authenticated RCE via object injection | cms made simple | 8.8 (v3.0) | High |
| CVE-2020-14321 | Moodle Teacher Enrollment Privilege Escalation to RCE | moodle | 8.8 (v3.1) | High |
| CVE-2020-27386 | FlexDotnetCMS Arbitrary ASP File Upload | flexdotnetcms | 8.8 (v3.1) | High |
| CVE-2020-27387 | HorizontCMS Arbitrary PHP File Upload | horizontcms | 8.8 (v3.1) | High |
| CVE-2020-7246 | qdPM 9.1 Authenticated Arbitrary PHP File Upload (RCE) | qdpm | 8.8 (v3.1) | High |
| CVE-2021-24347 | Wordpress Plugin SP Project and Document - Authenticated Remote Code Execution | sp project & document manager | 8.8 (v3.1) | High |
| CVE-2021-41282 | pfSense Diag Routes Web Shell Upload | pfsense | 8.8 (v3.1) | High |
| CVE-2021-43258 | ChurchInfo 1.2.13-1.3.0 Authenticated RCE | churchinfo | 8.8 (v3.1) | High |
| CVE-2022-0824 | Webmin File Manager RCE | webmin | 8.8 (v3.1) | High |
| CVE-2022-3405 | Acronis Cyber Protect/Backup machine info disclosure | cyber backup | 8.8 (v3.1) | High |
| CVE-2023-22952 | SugarCRM unauthenticated Remote Code Execution (RCE) | sugarcrm | 8.8 (v3.1) | High |
| CVE-2023-32707 | Splunk "edit_user" Capability Privilege Escalation | splunk | 8.8 (v3.1) | High |
| CVE-2023-38836 | BoidCMS Command Injection | boidcms | 8.8 (v3.1) | High |
| CVE-2023-46214 | Splunk Authenticated XSLT Upload RCE | cloud | 8.8 (v3.1) | High |
| CVE-2024-1800 | Telerik Report Server Auth Bypass and Deserialization RCE | telerik report server | 8.8 (v3.1) | High |
| CVE-2024-21683 | Atlassian Confluence Administrator Code Macro Remote Code Execution | confluence data center | 8.8 (v3.1) | High |
| CVE-2025-34511 | Sitecore XP CVE-2025-34511 Post-Authentication File Upload | experience commerce | 8.8 (v3.1) | High |
| CVE-2025-49113 | Roundcube Post-Auth RCE via PHP Object Deserialization | webmail | 8.8 (v3.1) | High |
| CVE-2025-68613 | n8n Workflow Expression Remote Code Execution | n8n | 8.8 (v3.1) | High |
| CVE-2013-10032 | GetSimpleCMS PHP File Upload Vulnerability | getsimplecms | 8.7 (v4.0) | High |
| CVE-2025-24367 | Cacti Graph Template authenticated RCE versions prior to 1.2.29 | cacti | 8.7 (v4.0) | High |
| CVE-2015-8279 | Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload | web viewer | 8.6 (v3.0) | High |
| CVE-2025-34097 | ProcessMaker Plugin Upload | ProcessMaker | 8.6 (v4.0) | High |
| CVE-2016-3081 | Apache Struts Dynamic Method Invocation Remote Code Execution | agile controller-campus firmware | 8.1 (v3.1) | High |
| CVE-2025-2563 | WP User Registration and Membership Unauthenticated Privilege Escalation (CVE-2025-2563) | user registration & membership | 8.1 (v3.1) | High |
| CVE-2025-48828 | vBulletin replaceAdTemplate Remote Code Execution | vbulletin | 8.1 (v3.1) | High |
| CVE-2018-15710 | Nagios XI Magpie_debug.php Root Remote Code Execution | nagios xi | 7.8 (v3.0) | High |
| CVE-2019-9624 | Webmin Upload Authenticated RCE | webmin | 7.8 (v3.0) | High |
| CVE-2003-0050 | QuickTime Streaming Server parse_xml.cgi Remote Execution | darwin streaming server | 7.5 (v2.0) | High |
| CVE-2005-2733 | Simple PHP Blog Remote Command Execution | simple php blog | 7.5 (v2.0) | High |
| CVE-2007-1036 | JBoss JMX Console Deployer Upload and Execute | jboss application server | 7.5 (v2.0) | High |
| CVE-2008-6508 | Openfire Admin Console Authentication Bypass | openfire | 7.5 (v2.0) | High |
| CVE-2009-3548 | Apache Tomcat Manager Authenticated Upload Code Execution | tomcat | 7.5 (v2.0) | High |
| CVE-2009-4140 | OpenEMR PHP File Upload Vulnerability | open flash chart | 7.5 (v2.0) | High |
| CVE-2010-0557 | Apache Tomcat Manager Authenticated Upload Code Execution | cognos express | 7.5 (v2.0) | High |
| CVE-2010-4417 | Oracle BeeHive 2 voice-servlet processEvaluation() Vulnerability | beehive | 7.5 (v2.0) | High |
| CVE-2011-4075 | phpLDAPadmin query_engine Remote PHP Code Injection | phpldapadmin | 7.5 (v2.0) | High |
| CVE-2011-4453 | PmWiki pagelist.php Remote PHP Code Injection Exploit | pmwiki | 7.5 (v2.0) | High |
| CVE-2012-5223 | vBSEO proc_deutf() Remote PHP Code Injection | vbseo | 7.5 (v2.0) | High |
| CVE-2012-6329 | TWiki MAKETEXT Remote Command Execution | perl | 7.5 (v2.0) | High |
| CVE-2013-0209 | Movable Type 4.2x, 4.3x Web Upgrade Remote Code Execution | movable type | 7.5 (v2.0) | High |
| CVE-2013-1081 | Novell Zenworks Mobile Managment MDM.php Local File Inclusion Vulnerability | zenworks mobile management | 7.5 (v2.0) | High |
| CVE-2013-1349 | OpenSIS 'modname' PHP Code Execution | opensis | 7.5 (v2.0) | High |
| CVE-2013-1412 | DataLife Engine preview.php PHP Code Injection | datalife engine | 7.5 (v2.0) | High |
| CVE-2013-4557 | SPIP connect Parameter PHP Injection | spip | 7.5 (v2.0) | High |
| CVE-2013-5036 | Squash YAML Code Execution | square squash | 7.5 (v2.0) | High |
| CVE-2014-1691 | Horde Framework Unserialize PHP Code Execution | horde application framework | 7.5 (v2.0) | High |
| CVE-2014-3704 | Drupal < 7.32 "Drupalgeddon" SQL Injection (CVE-2014-3704) | drupal | 7.5 (v2.0) | High |
| CVE-2014-5005 | ManageEngine Desktop Central StatusUpdate Arbitrary File Upload | manageengine desktop central | 7.5 (v2.0) | High |
| CVE-2014-5519 | Phpwiki Ploticus Remote Code Execution | phpwiki | 7.5 (v2.0) | High |
| CVE-2014-6446 | Wordpress InfusionSoft Upload Vulnerability | infusionsoft gravity forms | 7.5 (v2.0) | High |
| CVE-2014-7146 | MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability | mantisbt | 7.5 (v2.0) | High |
| CVE-2014-9567 | ProjectSend Arbitrary File Upload | projectsend | 7.5 (v2.0) | High |
| CVE-2015-2208 | PHPMoAdmin 1.1.2 Remote Code Execution | phpmoadmin | 7.5 (v2.0) | High |
| CVE-2020-5849 | Unraid 6.8.0 Auth Bypass PHP Code Execution | unraid | 7.5 (v3.1) | High |
| CVE-2022-30995 | Acronis Cyber Protect/Backup machine info disclosure | cyber backup | 7.5 (v3.1) | High |
| CVE-2025-34086 | Bolt CMS 3.7.0 - Authenticated Remote Code Execution | bolt | 7.5 (v4.0) | High |
| CVE-2016-1713 | Vtiger CRM - Authenticated Logo Upload RCE | vtiger crm | 7.3 (v3.0) | High |
| CVE-2018-1000094 | CMS Made Simple Authenticated RCE via File Upload/Copy | cms made simple | 7.2 (v3.0) | High |
| CVE-2020-25042 | MaraCMS Arbitrary PHP File Upload | maracms | 7.2 (v3.1) | High |
| CVE-2020-5792 | Nagios XI 5.5.0-5.7.3 - Snmptrap Authenticated Remote Code Exection | nagios xi | 7.2 (v3.1) | High |
| CVE-2022-24734 | MyBB Admin Control Code Injection RCE | mybb | 7.2 (v3.1) | High |
| CVE-2023-28128 | Ivanti Avalanche FileStoreConfig File Upload | avalanche | 7.2 (v3.1) | High |
| CVE-2023-31742 | Linksys WRT54GL Remote Command Execution | wrt54gl firmware | 7.2 (v3.1) | High |
| CVE-2023-46818 | ISPConfig language_edit.php PHP Code Injection | ispconfig | 7.2 (v3.1) | High |
| CVE-2024-25641 | Cacti Import Packages RCE | cacti | 7.2 (v3.1) | High |
| CVE-2025-68109 | ChurchCRM Database Restore RCE 6.2.0 | churchcrm | 7.2 (v3.1) | High |
| CVE-2025-34441 | AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery | avideo | 6.9 (v4.0) | Medium |
| CVE-2025-34442 | AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery | avideo | 6.9 (v4.0) | Medium |
| CVE-2008-6132 | phpScheduleIt PHP reserve.php start_date Parameter Arbitrary Code Injection | phpscheduleit | 6.8 (v2.0) | Medium |
| CVE-2008-6825 | Trixbox langChoice PHP Local File Inclusion | trixbox | 6.8 (v2.0) | Medium |
| CVE-2015-2995 | SysAid Help Desk 'rdslogs' Arbitrary File Upload | sysaid | 6.8 (v2.0) | Medium |
| CVE-2014-8998 | X7 Chat 2.0.5 lib/message.php preg_replace() PHP Code Execution | x7 chat | 6.5 (v2.0) | Medium |
| CVE-2014-9308 | WordPress WP EasyCart Unrestricted File Upload | wp easycart | 6.5 (v2.0) | Medium |
| CVE-2015-7309 | CMS Bolt File Upload Vulnerability | bolt | 6.5 (v2.0) | Medium |
| CVE-2014-8598 | MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability | mantisbt | 6.4 (v2.0) | Medium |
| CVE-2023-41425 | WonderCMS Remote Code Execution | wondercms | 6.1 (v3.1) | Medium |
| CVE-2011-3833 | Support Incident Tracker Remote Command Execution | support incident tracker | 6.0 (v2.0) | Medium |
| CVE-2013-2121 | Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection | openstack | 6.0 (v2.0) | Medium |
| CVE-2013-3238 | phpMyAdmin Authenticated Remote Code Execution via preg_replace() | phpmyadmin | 6.0 (v2.0) | Medium |
| CVE-2014-1610 | MediaWiki Thumb.php Remote Command Execution | mediawiki | 6.0 (v2.0) | Medium |
| CVE-2014-8791 | Tuleap PHP Unserialize Code Execution | tuleap | 6.0 (v2.0) | Medium |
| CVE-2025-52367 | PivotX Remote Code Execution | pivotx | 5.4 (v3.1) | Medium |
| CVE-2010-0738 | JBoss Vulnerability Scanner | jboss enterprise application platform | 5.3 (v3.1) | Medium |
| CVE-2019-1622 | Cisco Data Center Network Manager Unauthenticated Remote Code Execution | data center network manager | 5.3 (v3.1) | Medium |
| CVE-2024-28397 | Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397) | pyload | 5.3 (v3.1) | Medium |
| CVE-2011-0518 | LotusCMS 3.0 eval() Remote Command Execution | fraise | 5.1 (v2.0) | Medium |
| CVE-2010-4094 | Apache Tomcat Manager Authenticated Upload Code Execution | rational quality manager | 5.0 (v2.0) | Medium |
| CVE-2014-6034 | ManageEngine OpManager and Social IT Arbitrary File Upload | manageengine social it plus | 5.0 (v2.0) | Medium |
| CVE-2011-4642 | Splunk Search Remote Code Execution | splunk | 4.6 (v2.0) | Medium |
| CVE-2011-3829 | Support Incident Tracker Remote Command Execution | support incident tracker | 4.0 (v2.0) | Medium |
| CVE-2025-14730 | CTCMS Content Management System Backend System Configuration Ct_Config.php code injection | ctcms | 2.0 (v4.0) | Low |
| CVE-2012-6315 | Movable Type 4.2x, 4.3x Web Upgrade Remote Code Execution | - | N/A | N/A |
| CVE-2025-0655 | D-Tale RCE | - | N/A | N/A |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.