Modified WAF Objects: [total: 1]
==================================
Signature:
    ID: '401122'
    Name: WEB-MISC /etc/passwd
    Attack: Illegal Resource Access - Blocking
    Attack Class: Illegal Resource Access
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="/etc/", part="passwd", rgxp="\/etc\/{1,}passwd"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - url-and-parameters


New WAF Objects: [total: 6]
==================================
Policy:
  name: SharePoint Server Control Injection
  id: '20000415'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request Method
    operation: At Least One
    values:
    - POST
  - type: HTTP Request
    operation: Match All
    match values:
    - part: url
      operation: includes
      value: /_layouts/
    - part: parameter
      name: ctrlPresentationImage
      operation: includes
      value: SharePoint:ConnectionClientSettings
    - part: parameter
      name: ctrlPresentationImage
      operation: includes
      value: runat
    - part: url
      operation: includes
      value: .aspx

Policy:
  name: 'CVE-2026-88771: Citrix NetScaler - Command Injection RCE'
  id: '20000414'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: login
      operation: MatchRegExp
      value: '[/&/;/|/:/`/>/</'']{1,}[\s\S]{2,}'
  - type: HTTP Request Method
    operation: At Least One
    values:
    - POST
  - type: HTTP Request
    operation: Match Any
    match values:
    - part: url
      operation: includes
      value: /logon/LogonPoint/tmindex.html
    - part: url
      operation: includes
      value: /cgi/login
    - part: url
      operation: includes
      value: /nf/auth/doAuthentication.do
    - part: url
      operation: includes
      value: /p/u/doLogon.do

Policy:
  name: 'CVE-2026-94127: F5 BIG-IP APM - Heap Buffer Overflow'
  id: '20000413'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request
    operation: Match All
    match values:
    - part: header
      name: Authorization
      operation: MatchRegExp
      value: .{1500,}
    - part: header
      name: Authorization
      operation: includes
      value: Bearer
    - part: url
      operation: includes
      value: /f5-oauth2/

Policy:
  name: 'CVE-2026-50522: SharePoint Deserialization RCE'
  id: '20000412'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: wresult
      operation: includes
      value: Cookie
    - part: url
      operation: includes
      value: /_trust/default.aspx
    - part: parameter
      name: wresult
      operation: includes
      value: SecurityContextToken
  - type: HTTP Request Method
    operation: At Least One
    values:
    - POST

Signature:
    ID: '708605'
    Name: 'Click2Shell: Preauth WordPress Core - Theme Preview Injection 2'
    Attack: Directory Traversal
    Attack Class: Directory Traversal
    Dictionary: Recommended for Blocking for Web Applications
    Pattern: part="/wp-admin/admin-ajax.php", part="wp_customize=on", part="customize_theme=mobile-repair-zone", part="action=mobile_repair_zone_install_and_activate_plugin"
    Policy: Recommended Signatures Policy for Web Applications
    Search In:
    - url-and-parameters

Policy:
  name: 'Click2Shell: Preauth WordPress Core - Theme Preview Injection'
  id: '20000411'
  minimum version: '10.0'
  predicates:
  - type: HTTP Request
    operation: Match All
    match values:
    - part: parameter
      name: theme
      operation: MatchRegExp
      value: '[\"\]\*>]{2,}'
    - part: url
      operation: includes
      value: /wp-admin/theme-install.php