alert http any any -> any any (msg:"CVE-2026-38360: dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal (dash-uploader)"; content:"POST"; http_method; content:"/api/dash-uploader"; nocase; http_uri; content:"name=|22|flowChunkNumber|22|"; nocase; http_client_body; content:"name=|22|flowChunkSize|22|"; nocase; http_client_body; content:"name=|22|flowCurrentChunkSize|22|"; nocase; http_client_body; content:"../"; nocase; http_client_body; reference:cve,2026-38360; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-38360; reference:url,github.com/a1ohadance/CVE-2026-38360; classtype:web-application-attack; sid:22026001; rev:1;)
alert http any any -> any any (msg:"CVE-2026-38360: dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal (resumable)"; content:"POST"; http_method; content:"/api/resumable"; nocase; http_uri; content:"name=|22|resumableChunkNumber|22|"; nocase; http_client_body; content:"name=|22|resumableChunkSize|22|"; nocase; http_client_body; content:"name=|22|resumableCurrentChunkSize|22|"; nocase; http_client_body; content:"../"; nocase; http_client_body; reference:cve,2026-38360; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-38360; reference:url,github.com/a1ohadance/CVE-2026-38360; classtype:web-application-attack; sid:22026002; rev:1;)
alert http any any -> any any (msg:"CVE-2026-29014: MetInfo CMS <= 8.1 - Remote Code Execution"; content:"POST"; http_method; content:"/app/system/entrance.php"; nocase; http_uri; content:"eval("; nocase; http_client_body; content:"../"; nocase; http_client_body; reference:cve,2026-29014; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-29014; reference:url,www.metinfo.cn; classtype:web-application-attack; sid:22026003; rev:1;)
alert http any any -> any any (msg:"CVE-2026-3300: Everest Forms Pro <= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection - Remote Code Execution (admin-ajax.php)"; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; nocase; http_uri; content:"action=everest_forms_ajax_form_submission"; nocase; http_client_body; content:"everest_forms[id]="; nocase; http_client_body; content:"system("; nocase; http_client_body; reference:cve,2026-3300; reference:url,everestforms.net/changelog; reference:url,www.wordfence.com/threat-intel/vulnerabilities/id/389c0b89-e408-4ad5-9723-a16b745771f0?source=cve; classtype:web-application-attack; sid:22026004; rev:1;)
alert http any any -> any any (msg:"CVE-2026-3300: Everest Forms Pro <= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection - Remote Code Execution (pages)"; content:"GET"; http_method; content:"/wp-json/wp/v2/pages"; nocase; http_uri; content:"per_page=100"; nocase; http_uri; reference:cve,2026-3300; reference:url,everestforms.net/changelog; reference:url,www.wordfence.com/threat-intel/vulnerabilities/id/389c0b89-e408-4ad5-9723-a16b745771f0?source=cve; classtype:web-application-attack; sid:22026005; rev:1;)
alert http any any -> any any (msg:"CVE-2026-40887: Vendure Core - SQL Injection"; content:"POST"; http_method; content:"/shop-api"; nocase; http_uri; content:"languageCode="; nocase; http_uri; content:"EXTRACTVALUE("; nocase; http_uri; content:"CONCAT(0x"; nocase; http_uri; reference:cve,2026-40887; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-40887; reference:url,github.com/advisories/GHSA-9pp3-53p2-ww9v; classtype:web-application-attack; sid:22026006; rev:1;)
alert http any any -> any any (msg:"CVE-2026-8037: Progress ADC LoadMaster - Command Injection - Remote Code Execution"; content:"POST"; http_method; content:"/accessv2"; nocase; http_uri; content:"/etc/passwd"; nocase; http_client_body; content:"|3B| cat"; nocase; http_client_body; reference:cve,2026-8037; reference:url,community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691; classtype:web-application-attack; sid:22026007; rev:1;)
alert http any any -> any any (msg:"CVE-2026-22557: UniFi Network Application - Path Traversal - Local File Inclusion"; content:"GET"; http_method; content:"/guest/s/default/login"; nocase; http_uri; content:"page_error="; nocase; http_uri; content:"../"; nocase; http_uri; reference:cve,2026-22557; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-22557; reference:url,github.com/ThePotatoOfDoom/CVE-2026-22557-PoC; classtype:web-application-attack; sid:22026008; rev:1;)
alert http any any -> any any (msg:"CVE-2026-27174: MajorDoMo - Unauthenticated RCE - Remote Code Execution"; content:"GET"; http_method; content:"/admin.php"; nocase; http_uri; content:"ajax_panel="; nocase; http_uri; content:"command="; nocase; http_uri; content:"/etc/passwd"; nocase; http_uri; reference:cve,2026-27174; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-27174; reference:url,github.com/sergejey/majordomo/issues/1177; classtype:web-application-attack; sid:22026009; rev:1;)
alert http any any -> any any (msg:"CVE-2026-27971: Qwik - Unauthenticated RCE via server$ Deserialization - Remote Code Execution"; content:"POST"; http_method; content:"qfunc=sync"; nocase; http_uri; content:"/etc/passwd"; nocase; http_client_body; reference:cve,2026-27971; reference:url,vulnerabletarget.com/VT-2026-27971; reference:url,github.com/QwikDev/qwik/security/advisories/GHSA-p9x5-jp3h-96mm; classtype:web-application-attack; sid:22026010; rev:1;)
alert http any any -> any any (msg:"CVE-2026-34156: NocoBase - VM Sandbox Escape to Remote Code Execution"; content:"POST"; http_method; content:"/api/flow_nodes|3A|test"; nocase; http_uri; content:"/etc/passwd"; nocase; http_client_body; reference:cve,2026-34156; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-34156; reference:url,github.com/advisories/GHSA-px3p-vgh9-m57c; classtype:web-application-attack; sid:22026011; rev:1;)
alert http any any -> any any (msg:"CVE-2026-34910: UniFi OS Server - Command Injection - Remote Code Execution"; content:"GET"; http_method; content:"/proxy/users/api/v2/ucs/update/latest_package"; nocase; http_uri; content:"pkg_name="; nocase; http_uri; content:"nslookup"; nocase; http_uri; reference:cve,2026-34910; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-34910; reference:url,www.it-connect.tech/critical-3-exploit-chain-grants-root-access-on-unifi-os-server; classtype:web-application-attack; sid:22026012; rev:1;)
alert http any any -> any any (msg:"CVE-2026-6875: ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE - Remote Code Execution"; content:"GET"; http_method; content:"/assessment_thanks.do"; nocase; http_uri; content:"sysparm_assessable_type="; nocase; http_uri; content:"javascript|3A|"; nocase; http_uri; reference:cve,2026-6875; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-6875; reference:url,github.com/tc4dy/CVE-2026-6875-PoC-Exploit; classtype:web-application-attack; sid:22026013; rev:1;)
alert http any any -> any any (msg:"CVE-2026-8054: dotCMS Core Publish Audit API - Unauthenticated SQL Injection"; content:"POST"; http_method; content:"/api/auditpublishing/getall"; nocase; http_uri; content:"pg_sleep("; nocase; http_client_body; reference:cve,2026-8054; reference:url,github.com/dotCMS/core/pull/35553; reference:url,github.com/advisories/GHSA-jpx3-25r2-jq5g; classtype:web-application-attack; sid:22026014; rev:1;)
alert http any any -> any any (msg:"CVE-2026-1830: Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload - Remote Code Execution"; content:"POST"; http_method; content:"/wp-json/quickplayground/v1/upload_image/default"; nocase; http_uri; content:"../"; nocase; http_client_body; reference:cve,2026-1830; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-1830; reference:url,plugins.trac.wordpress.org/browser/quick-playground/trunk/api.php#L39; classtype:web-application-attack; sid:22026015; rev:1;)
alert http any any -> any any (msg:"CVE-2026-28496: FOSSBilling - Server-Side Template Injection - SQL Injection"; content:"POST"; http_method; content:"/api/system/system/string_render"; nocase; http_uri; content:"@@version"; nocase; http_client_body; reference:cve,2026-28496; reference:url,x.com/pyn3rd/status/2069260345571696951; reference:url,www.vulncheck.com/blog/fossbilling-auth-bypass-ssti-rce; classtype:web-application-attack; sid:22026016; rev:1;)
alert http any any -> any any (msg:"CVE-2026-41179: RClone RC - Command Injection - Remote Code Execution"; content:"POST"; http_method; content:"/operations/fsinfo"; nocase; http_uri; content:"curl"; nocase; http_client_body; reference:cve,2026-41179; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-41179; reference:url,github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q; classtype:web-application-attack; sid:22026017; rev:1;)
alert http any any -> any any (msg:"CVE-2026-46442: Flowise < 3.1.2 - node-custom-function Unauthorized RCE - Remote Code Execution"; content:"POST"; http_method; content:"/api/v1/node-custom-function"; nocase; http_uri; content:"nslookup"; nocase; http_client_body; reference:cve,2026-46442; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-46442; reference:url,github.com/FlowiseAI/Flowise; classtype:web-application-attack; sid:22026018; rev:1;)
alert http any any -> any any (msg:"CVE-2026-47668: DbGate - Remote Code Execution via Anonymous JWT (+1 related templates share this request signature)"; content:"POST"; http_method; content:"/runners/start"; nocase; http_uri; content:"nslookup"; nocase; http_client_body; reference:cve,2026-47668; reference:url,github.com/dbgate/dbgate; reference:url,www.cve.org/CVERecord?id=CVE-2026-47668; classtype:web-application-attack; sid:22026019; rev:1;)
alert http any any -> any any (msg:"CVE-2026-65694: Microweber CMS <= 2.0.20 - Unauthenticated Arbitrary File Read - Local File Inclusion"; content:"GET"; http_method; content:"/userfiles/x"; nocase; http_uri; content:"path="; nocase; http_uri; content:"/etc/passwd"; nocase; http_uri; content:"../"; nocase; http_uri; reference:cve,2026-65694; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-65694; reference:url,github.com/abdugafforov-bobur/CVE-2026-65694-PoC; classtype:web-application-attack; sid:22026020; rev:1;)
alert http any any -> any any (msg:"CVE-2026-27483: MindsDB - Remote Code Execution"; content:"PUT"; http_method; content:"/api/files"; nocase; http_uri; content:"name=|22|name|22|"; nocase; http_client_body; content:"name=|22|source|22|"; nocase; http_client_body; content:"name=|22|source_type|22|"; nocase; http_client_body; content:"../"; nocase; http_client_body; reference:cve,2026-27483; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-27483; reference:url,github.com/mindsdb/mindsdb/releases/tag/v25.9.1.1; classtype:web-application-attack; sid:22026021; rev:1;)
alert http any any -> any any (msg:"CVE-2026-5027: Langflow <= 1.8.4 - Path Traversal to RCE via File Upload - Local File Inclusion (files)"; content:"POST"; http_method; content:"/api/v2/files"; nocase; http_uri; content:"name=|22|file|22|"; nocase; http_client_body; content:"../"; nocase; http_client_body; reference:cve,2026-5027; reference:url,github.com/0xBlackash/CVE-2026-5027; reference:url,github.com/langflow-ai/langflow/pull/12227; classtype:web-application-attack; sid:22026022; rev:1;)
alert http any any -> any any (msg:"CVE-2026-5027: Langflow <= 1.8.4 - Path Traversal to RCE via File Upload - Local File Inclusion (login)"; content:"POST"; http_method; content:"/api/v1/login"; nocase; http_uri; content:"username="; nocase; http_client_body; reference:cve,2026-5027; reference:url,github.com/0xBlackash/CVE-2026-5027; reference:url,github.com/langflow-ai/langflow/pull/12227; classtype:web-application-attack; sid:22026023; rev:1;)
alert http any any -> any any (msg:"CVE-2026-28414: Gradio - Absolute Path Traversal - Local File Inclusion"; content:"GET"; http_method; content:"/static/windows/win.ini"; nocase; http_uri; reference:cve,2026-28414; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-28414; reference:url,github.com/gradio-app/gradio/security/advisories/GHSA-39mp-8hj3-5c49; classtype:web-application-attack; sid:22026024; rev:1;)
alert http any any -> any any (msg:"CVE-2026-35029: LiteLLM - Arbitrary File Read - Local File Inclusion"; content:"POST"; http_method; content:"/config/update"; nocase; http_uri; content:"/etc/passwd"; nocase; http_client_body; reference:cve,2026-35029; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-35029; reference:url,github.com/BerriAI/litellm; classtype:web-application-attack; sid:22026025; rev:1;)
alert http any any -> any any (msg:"CVE-2026-40466: Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass"; content:"POST"; http_method; content:"/api/jolokia"; nocase; http_uri; content:"java.lang.String"; nocase; http_client_body; reference:cve,2026-40466; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-40466; reference:url,github.com/apache/activemq/pull/1918; classtype:web-application-attack; sid:22026026; rev:1;)
alert http any any -> any any (msg:"CVE-2026-34885: WordPress Media Library Assistant <= 3.34 - SQL Injection (posts)"; content:"POST"; http_method; content:"/wp-json/wp/v2/posts"; nocase; http_uri; content:"CONCAT(0x"; nocase; http_client_body; reference:cve,2026-34885; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-34885; reference:url,plugins.svn.wordpress.org/media-library-assistant/tags; classtype:web-application-attack; sid:22026027; rev:1;)
alert http any any -> any any (msg:"CVE-2026-34885: WordPress Media Library Assistant <= 3.34 - SQL Injection (admin-ajax.php)"; content:"GET"; http_method; content:"/wp-admin/admin-ajax.php"; nocase; http_uri; content:"action=rest-nonce"; nocase; http_uri; reference:cve,2026-34885; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-34885; reference:url,plugins.svn.wordpress.org/media-library-assistant/tags; classtype:web-application-attack; sid:22026028; rev:1;)
alert http any any -> any any (msg:"CVE-2026-6118: AstrBot <= 4.22.1 - Command Injection - Remote Code Execution"; content:"POST"; http_method; content:"/api/tools/mcp/add"; nocase; http_uri; content:"nslookup"; nocase; http_client_body; reference:cve,2026-6118; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-6118; reference:url,github.com/AstrBotDevs/AstrBot/issues/7169; classtype:web-application-attack; sid:22026029; rev:1;)
alert http any any -> any any (msg:"CVE-2026-9290: WP User Manager – User Profile Builder & Membership - Local File Inclusion"; content:"GET"; http_method; content:"/profile/admin/about"; nocase; http_uri; content:"../"; nocase; http_uri; reference:cve,2026-9290; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-9290; classtype:web-application-attack; sid:22026030; rev:1;)
alert http any any -> any any (msg:"CVE-2026-3396: WCAPF WooCommerce Ajax Product Filter - SQL Injection"; content:"GET"; http_method; content:"filter_post_author="; nocase; http_uri; content:"SLEEP(6"; nocase; http_uri; reference:cve,2026-3396; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-3396; classtype:web-application-attack; sid:22026031; rev:1;)
alert http any any -> any any (msg:"CVE-2026-21859: Mailpit < 1.28.3 - Server-Side Request Forgery"; content:"GET"; http_method; content:"/proxy"; nocase; http_uri; content:"127.0.0.1"; nocase; http_uri; reference:cve,2026-21859; reference:url,github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr; reference:url,rosecurify.com/advisories/RO-26-001-mailpit-server-side-request-forgery-ssrf; classtype:web-application-attack; sid:22026032; rev:1;)
alert http any any -> any any (msg:"CVE-2026-41640: NocoBase - SQL Injection ({{to_lower(rand_base(8))}}:create)"; content:"POST"; http_method; content:"UNION ALL SELECT"; nocase; http_client_body; reference:cve,2026-41640; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-41640; reference:url,github.com/advisories/GHSA-4948-f92q-f432; classtype:web-application-attack; sid:22026033; rev:1;)
alert http any any -> any any (msg:"CVE-2026-41640: NocoBase - SQL Injection ({{to_lower(rand_base(8))}}:list)"; content:"GET"; http_method; content:"appends[]="; nocase; http_uri; content:"pageSize=100"; nocase; http_uri; reference:cve,2026-41640; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-41640; reference:url,github.com/advisories/GHSA-4948-f92q-f432; classtype:web-application-attack; sid:22026034; rev:1;)
alert http any any -> any any (msg:"CVE-2026-24128: XWiki Platform Distribution Flavor Main - Cross-Site Scripting"; content:"GET"; http_method; content:"/xwiki/bin/view/xwiki/main"; nocase; http_uri; content:"xpage=distribution"; nocase; http_uri; content:"extensionSection=progress"; nocase; http_uri; content:"extensionId="; nocase; http_uri; content:"<img"; nocase; http_uri; content:"onerror="; nocase; http_uri; reference:cve,2026-24128; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-24128; reference:url,jira.xwiki.org/browse/XWIKI-23462; classtype:web-application-attack; sid:22026035; rev:1;)
alert http any any -> any any (msg:"CVE-2026-40105: XWiki - Cross-Site Scripting"; content:"GET"; http_method; content:"/bin/view/sandbox"; nocase; http_uri; content:"viewer=changes"; nocase; http_uri; content:"rev1=9.1"; nocase; http_uri; content:"rev2="; nocase; http_uri; content:"<script"; nocase; http_uri; content:"alert("; nocase; http_uri; reference:cve,2026-40105; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-40105; reference:url,jira.xwiki.org/browse/XWIKI-22481; classtype:web-application-attack; sid:22026036; rev:1;)
alert http any any -> any any (msg:"CVE-2026-29183: SiYuan Note - Cross-Site Scripting"; content:"GET"; http_method; content:"/api/icon/getdynamicicon"; nocase; http_uri; content:"type="; nocase; http_uri; content:"content="; nocase; http_uri; content:"<script"; nocase; http_uri; content:"alert("; nocase; http_uri; reference:cve,2026-29183; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-29183; reference:url,github.com/siyuan-note/siyuan/security/advisories/GHSA-6865-qjcf-286f; classtype:web-application-attack; sid:22026037; rev:1;)
alert http any any -> any any (msg:"CVE-2026-50229: Apache Tomcat - Cross-Site Scripting"; content:"GET"; http_method; content:"/examples/jsp/num/numguess.jsp"; nocase; http_uri; content:"guess="; nocase; http_uri; content:"hint="; nocase; http_uri; content:"<script"; nocase; http_uri; content:"alert("; nocase; http_uri; reference:cve,2026-50229; reference:url,tomcat.apache.org/security-11.html; reference:url,www.cve.org/CVERecord?id=CVE-2026-50229; classtype:web-application-attack; sid:22026038; rev:1;)
alert http any any -> any any (msg:"CVE-2026-27176: MajorDoMo - Cross-Site Scripting"; content:"GET"; http_method; content:"/command.php"; nocase; http_uri; content:"<img"; nocase; http_uri; content:"onerror="; nocase; http_uri; reference:cve,2026-27176; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-27176; classtype:web-application-attack; sid:22026039; rev:1;)
alert http any any -> any any (msg:"CVE-2026-31807: SiYuan <= v3.5.9 - SVG Animate Element XSS - Cross-Site Scripting"; content:"GET"; http_method; content:"/api/icon/getdynamicicon"; nocase; http_uri; content:"type="; nocase; http_uri; content:"content="; nocase; http_uri; content:"color=blue"; nocase; http_uri; content:"javascript|3A|"; nocase; http_uri; reference:cve,2026-31807; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-31807; reference:url,github.com/siyuan-note/siyuan/security/advisories/GHSA-5hc8-qmg8-pw27; classtype:web-application-attack; sid:22026040; rev:1;)
alert http any any -> any any (msg:"CVE-2026-31809: SiYuan <= v3.5.9 - Cross Site Scripting - Cross-Site Scripting"; content:"GET"; http_method; content:"/api/icon/getdynamicicon"; nocase; http_uri; content:"type="; nocase; http_uri; content:"content="; nocase; http_uri; content:"color=blue"; nocase; http_uri; content:"alert("; nocase; http_uri; reference:cve,2026-31809; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-31809; reference:url,github.com/siyuan-note/siyuan/security/advisories/GHSA-pmc9-f5qr-2pcr; classtype:web-application-attack; sid:22026041; rev:1;)
alert http any any -> any any (msg:"CVE-2026-34605: SiYuan Note - Cross-Site Scripting"; content:"GET"; http_method; content:"/api/icon/getdynamicicon"; nocase; http_uri; content:"type="; nocase; http_uri; content:"color=red"; nocase; http_uri; content:"content="; nocase; http_uri; content:"alert("; nocase; http_uri; reference:cve,2026-34605; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-34605; reference:url,github.com/siyuan-note/siyuan/security/advisories/GHSA-73g7-86qr-jrg3; classtype:web-application-attack; sid:22026042; rev:1;)
alert http any any -> any any (msg:"CVE-2026-5615: VvvebJs <= 2.0.5 - Cross-Site Scripting"; content:"POST"; http_method; content:"/upload.php"; nocase; http_uri; content:"name=|22|file|22|"; nocase; http_client_body; content:"<svg"; nocase; http_client_body; content:"onload="; nocase; http_client_body; reference:cve,2026-5615; reference:url,github.com/givanz/VvvebJs; reference:url,github.com/advisories/GHSA-p873-9x3v-gmvh; classtype:web-application-attack; sid:22026043; rev:1;)
alert http any any -> any any (msg:"CVE-2026-27645: Changedetection.io RSS Single Watch - Cross-Site Scripting"; content:"GET"; http_method; content:"/rss/watch"; nocase; http_uri; content:"token="; nocase; http_uri; content:"<img"; nocase; http_uri; content:"onerror="; nocase; http_uri; reference:cve,2026-27645; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-27645; reference:url,github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-mw8m-398g-h89w; classtype:web-application-attack; sid:22026044; rev:1;)
alert http any any -> any any (msg:"CVE-2026-39352: Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal - Local File Inclusion (report)"; content:"POST"; http_method; content:"/api/resource/report"; nocase; http_uri; content:"/etc/passwd"; nocase; http_client_body; content:"../"; nocase; http_client_body; reference:cve,2026-39352; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-39352; reference:url,github.com/frappe/frappe/pull/38215; classtype:web-application-attack; sid:22026045; rev:1;)
alert http any any -> any any (msg:"CVE-2026-39352: Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal - Local File Inclusion (frappe.desk.query_report.get_script)"; content:"GET"; http_method; content:"/api/method/frappe.desk.query_report.get_script"; nocase; http_uri; content:"report_name=nuclei_cve2026_39352_"; nocase; http_uri; reference:cve,2026-39352; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-39352; reference:url,github.com/frappe/frappe/pull/38215; classtype:web-application-attack; sid:22026046; rev:1;)