New WAF Objects: [total: 8]
==================================
Signature:
    ID: '708508'
    Name: 'CVE-2025-31125: Vite - Information Exposure'
    Attack: Illegal Resource Access - Blocking
    Attack Class: Illegal Resource Access
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="@fs", rgxp="(import&\?inline|inline&\?import)="
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - url-and-parameters

Signature:
    ID: '708507'
    Name: 'CVE-2025-68645: Zimbra Collaboration - LFI'
    Attack: Illegal Resource Access - Blocking
    Attack Class: Illegal Resource Access
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="/h/rest", part="javax.servlet.include.servlet_path="
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - url-and-parameters

Signature:
    ID: '708506'
    Name: 'CVE-2026-23550: Modular DS - Privilege Escalation'
    Attack: Illegal Resource Access - Blocking
    Attack Class: Illegal Resource Access
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="/api/modular-connector/", part="origin=mo", part="type", rgxp="\/api\/modular-connector\/(login\/|server-information\/|manager\/|backup\/)"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - url-and-parameters

Signature:
    ID: '708505'
    Name: 'WT-2026-0001: Auth Bypass in SmarterTools SmarterMail'
    Attack: Authentication Bypass - Blocking
    Attack Class: Authentication Bypass
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="/api/v1/auth/force-reset-password", part="IsSysAdmin", rgxp="IsSysAdmin\=true"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - url-and-parameters

Policy:
  name: "CVE-2025-60188: Atarim Plugin Auth Bypass"
  id: "20000349"
  minimum_version: "10.0"
  predicates:
    - type: "HTTP Request"
      operation: "Match All"
      match values:
        - part: "url"
          operation: "includes"
          value: "/wp-admin/admin-ajax.php"
    - type: "HTTP Request Method"
      operation: "At Least One"
      values:
        - "POST"
    - type: "HTTP Request Header Value"
      name: "Request-Reference"
      operation: "At Least One"
      values:
        - "sys_admin_check"
    - type: "HTTP Request Parameter Name"
      operation: "At Least One"
      values:
        - "action"
    - type: "HTTP Request Header Name"
      operation: "At Least One"
      values:
        - "Request-Signature"

Signature:
    ID: '708503'
    Name: Reflected XSS using onbeforematch
    Attack: Cross-Site Scripting - Blocking
    Attack Class: Cross-Site Scripting
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="until-found", part="onbeforematch", rgxp="\<.{1,30}\s?hidden\=[\'\"]?until-found[\'\"]?[\s\S]{0,20}onbeforematch\=.{0,80}\>\#"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - parameters
    - headers

Signature:
    ID: '708502'
    Name: 'CVE-2025-60021: Apache bRPC - RCE'
    Attack: Remote Command Execution - Blocking
    Attack Class: Remote Command Execution
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="/pprof/heap", part="extra_options", rgxp="extra_options\=[\s\S]{0,50}[\'\"\|\&\;\`]"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - url-and-parameters

Signature:
    ID: '708501'
    Name: 'CVE-2026-22610: Angular SVG Flaw - XSS'
    Attack: Cross-Site Scripting - Blocking
    Attack Class: Cross-Site Scripting
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="<svg>", part="href", rgxp="\<svg\>[\s\S]*?(href|xlink:href)=[\s\S]*?((data:text\/javascript)|(https?:\/\/))[\s\S]{0,200}$"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - parameters
    - headers