New WAF Objects: [total: 4]
==================================
Signature:
  ID: '708417'
  Name: WordPress Easy WP SMTP plugin admin password reset
  Attack: Account Takeover - Blocking
  Attack Class: Account Takeover
  Dictionary: Recommended for Blocking for Web Applications
  Pattern: part="/wp-content/plugins/easy-wp-smtp/", part="_debug_log", rgxp="txt$"
  Policy: Recommended Signatures Policy for Web Applications
  Search In:
   - url

Policy:
  name: 'CVE-2025-57819: FreePBX - SQLI to RCE - 2'
  id: '20000327'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request
    operation: Match Any
    match values:
    - part: url
      operation: includes
      value: /admin/config.php
    - part: url
      operation: includes
      value: /admin/ajax.php
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: brand
      operation: MatchRegExp
      value: '[\''\`\"]'
    - part: parameter
      name: module
      operation: includes
      value: FreePBX\\modules\\endpoint\\ajax
  - type: HTTP Request Method
    operation: At Least One
    values:
    - GET

Policy:
  name: 'CVE-2025-57819: FreePBX - SQLI to RCE'
  id: '20000326'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request Method
    operation: At Least One
    values:
    - POST
  - type: HTTP Request
    operation: Match Any
    match values:
    - part: url
      operation: includes
      value: /admin/ajax.php
    - part: url
      operation: includes
      value: /admin/config.php
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: brand
      operation: MatchRegExp
      value: '[\''\`\"]'
    - part: parameter
      name: module
      operation: includes
      value: \FreePBX\modules\Endpoint\ajax

Policy:
  name: 'CVE-2025-5086: Dassualt DELMIA Apriso - RCE'
  id: '20000324'
  'minimum version': '10.0'
  predicates:
    - type: HTTP Request Method
      operation: At Least One
      values:
        - POST
    - type: HTTP Request
      operation: Match All
      match values:
        - part: url
          operation: includes
          value: /apriso/WebServices/FlexNetOperationsService.svc/Invoke
        - part: parameter
          name: ResourceDictionary/Array/Arguments/String
          operation: includes
          value: H4sI