New WAF Objects: [total: 11]
==================================
Signature:
    ID: '708586'
    Name: SQLi using Expression Language injection
    Attack: SQL Injection - Blocking
    Attack Class: SQL Injection
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="ctl00", rgxp="ctl00[\s\S]{1,60}\=[\'\"]\s?\|\|\s?\w{1,20}\.(?:startswith|endswith|contains|tolower|toupper|substring|indexof|trim)\s?\([\s\S]{1,20}\)\s?\|\|"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - parameters
    - headers

Signature:
    ID: '708585'
    Name: ysoserial.net deserialization payloads (3)
    Attack: Remote Command Execution - Blocking
    Attack Class: Remote Command Execution
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="Microsoft.VisualStudio.Text.Formatting.TextFormattingRunProperties"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - parameters
    - headers

Signature:
    ID: '708584'
    Name: ysoserial.net deserialization payloads (2)
    Attack: Remote Command Execution - Blocking
    Attack Class: Remote Command Execution
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="ObjectDataProvider.", rgxp="\bObjectDataProvider\.(?:ObjectInstance|MethodParameters)\b"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - parameters
    - headers

Signature:
    ID: '708583'
    Name: ysoserial.net deserialization payloads (1)
    Attack: Remote Command Execution - Blocking
    Attack Class: Remote Command Execution
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="System.", rgxp="System\.(?:Workflow\.ComponentModel\.Serialization\.ActivitySurrogateSelector|Windows\.Data\.ObjectDataProvider|Management\.Automation\.PSObject|DelegateSerializationHolder|Security\.ClaimsIdentity\.bootstrapContext|Collections\.Generic\.ComparisonComparer|Security\.Principal\.WindowsIdentity)"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - parameters
    - headers

Policy:
  name: 'CVE-2026-49049: Helix3 Joomla Plugin - Unauthenticated  RCE'
  id: '20000386'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request
    operation: Match All
    match values:
    - part: url
      operation: includes
      value: /index.php
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: option
      operation: includes
      value: com_ajax
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: plugin
      operation: includes
      value: helix3
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: format
      operation: includes
      value: json
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: data[action]
      operation: MatchRegExp
      value: (save|remove|import)

Signature:
    ID: '708582'
    Name: CVE-2026-16723:FastJson 1.2.83 Remote Code Execution
    Attack: Remote Command Execution - Blocking
    Attack Class: Remote Command Execution
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="@type=jar:", rgxp="@type\=jar:(?:https?:|ftp:|file:\.proc\.self\.fd\.)"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - parameters

Signature:
    ID: '708581'
    Name: 'CVE-2026-3891: WooCommerce-Plugin - File Upload'
    Attack: Illegal Resource Access - Blocking
    Attack Class: Illegal Resource Access
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="/wp-admin/admin-ajax.php", part="action=lkn_pix_for_woocommerce_c6_save_settings", part=".ph"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - url-and-parameters

Policy:
  name: 'CVE-2026-25089: Fortinet FortiSandbox  - os command injection'
  id: '20000385'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: vm_name
      operation: MatchRegExp
      value: '[;|`&$]'
    - part: url
      operation: includes
      value: /api/vnc/start
    - part: header
      name: Content-Type
      operation: includes
      value: application/json
  - type: HTTP Request Method
    operation: At Least One
    values:
    - POST

Policy:
  name: 'CVE-2026-63030: wp2shell  - SQLi to RCE'
  id: '20000384'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request Method
    operation: At Least One
    values:
    - POST
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: requests.body.requests.path
      operation: MatchRegExp
      value: (?:SELECT|AND|FROM|CONCAT_WS|UNION|WHERE|OR|SUBSTRING|COALESCE)
    - part: header
      name: Content-Type
      operation: includes
      value: application/json
    - part: parameter
      name: requests.body.requests.path
      operation: includes
      value: author_exclude
  - type: HTTP Request
    operation: Match Any
    match values:
    - part: url
      operation: includes
      value: /wp-json/batch/v1
    - part: parameter
      name: rest_route
      operation: includes
      value: /batch/v1

Policy:
  name: CVE-2026-56291:Balbooa Forms for Joomla - Unrestricted File Upload
  id: '20000383'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request Method
    operation: At Least One
    values:
    - POST
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: id
      operation: MatchRegExp
      value: (?:\.ph|\.txt)
    - part: parameter
      name: option
      operation: includes
      value: com_baforms
    - part: url
      operation: includes
      value: index.php
    - part: header
      name: Content-Type
      operation: includes
      value: multipart/form-data
    - part: parameter
      name: task
      operation: includes
      value: form.uploadAttachmentFile

Policy:
  name: 'CVE-2026-48939: iCagenda Joomla Extension - Unrestricted File Upload'
  id: '20000383'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request Method
    operation: At Least One
    values:
    - POST
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: task
      operation: MatchRegExp
      value: (?:registration.submit|submit)
    - part: parameter
      name: jform[attachment]
      operation: MatchRegExp
      value: (?:\.ph|\.txt)
    - part: parameter
      name: option
      operation: includes
      value: com_icagenda
    - part: header
      name: Content-Type
      operation: includes
      value: multipart/form-data
    - part: url
      operation: includes
      value: index.php