This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45955. The new/improved rules of this upgrade package are:

new rules:

1. threat[32950]:Jeecg-Boot JimuReport /jmreport/queryFieldBySql SQL Injection Vulnerability
2. threat[20121]:Sangfor Operation Security Management System upload_file Remote Command Execution Vulnerability
3. threat[20119]:FANTEC MWiD25-DS Unauthorized Vulnerability(CVE-2022-28113)
4. threat[20118]:FatPipe Unauthorized Vulnerability(CVE-2021-27856)
5. threat[32955]:SAMSUNG Mobile devices security vulnerability (CVE-2021-25374)
6. threat[20117]:Sangfor Help Desk System save_SNMP Remote Command Execution Vulnerability
7. threat[32954]:Sangfor Operations Security Management System search_login has a token leakage vulnerability
8. threat[32953]:LabKey Server Code Injection Vulnerability (CVE-2019-9757)
9. threat[32952]:WordPress Plugin Cryptocurrency Widgets Pack SQL Injection Vulnerability (CVE-2022-44588)
10. threat[32951]:Tiandy Easy7 Integrated Management Platform SQL Injection Vulnerability(CVE-2026-4287)
11. threat[32957]:Sangfor Next-Generation Firewall /vmp_getinfo Privilege Bypass Vulnerability
12. threat[20122]:EsafeNet CDG SQL Injection Vulnerability (CVE-2024-10501)
13. threat[32958]:Tongda OA /export_data.php SQL Injection Vulnerability (CVE-2022-23902)
14. threat[32960]:WordPress plugin WP Hotel Booking Security Vulnerability (CVE-2024-3605)
15. threat[32959]:Dongsheng Logistics Software CrmProxyMailListHtmlGridSource.aspx SQL Injection Vulnerability
16. threat[32956]:Dahua Smart Park Comprehensive Management Platform Information Disclosure Vulnerability
17. threat[20120]:Dahua ICC Smart IoT Comprehensive Management Platform Server-Side Request Forgery (SSRF) Vulnerability




Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45939. The new/improved rules of this upgrade package are:

new rules:

1. threat[20106]:GitLab GraphQL Code Injection Vulnerability (CVE-2026-19478)
2. threat[20114]:Comfy Org ComfyUI Deserialization Vulnerability(CVE-2026-68771)
3. threat[20115]:WordPress ProfilePress Plugin Privilege Escalation Vulnerability (CVE-2021-34622)
4. threat[20103]:EsafeNet CDG SQL Injection Vulnerability(CVE-2024-10594)
5. threat[32947]:WordPress Plugin InfiniteWP Client Information Disclosure Vulnerability(CVE-2023-2916)
6. threat[20113]:WordPress Visualizer Plugin Code Execution Vulnerability (CVE-2019-16932)
7. threat[20112]:Carel pCOWeb Trust Management Vulnerability (CVE-2019-11369)
8. threat[20110]:DataEase Cross-Site Scripting Vulnerability (CVE-2026-32139)
9. threat[32946]:WordPress Plugin EWWW Image Optimizer Information Disclosure Vulnerability (CVE-2023-40600)
10. threat[20109]:WordPress Plugin Elementor Pro Security Vulnerability (CVE-2023-3124)
11. threat[32945]:WordPress Plugin Information Disclosure Vulnerability (CVE-2021-39327)
12. threat[32944]:Customer Support System SQL Injection Vulnerability (CVE-2023-50070)
13. threat[20108]:Kirby Security Vulnerability (CVE-2023-38490)
14. threat[20116]:ESAFENET CDG SQL Injection Vulnerability (CVE-2024-10502)
15. threat[32948]:Sangfor Next-Generation Firewall HttpHandler.php Sensitive Information Disclosure Vulnerability
16. threat[32949]:Sobey Convergent Media System queryBySQL SQL Injection Vulnerability


update rules:

1. threat[32772]:NineJiaYi Management System picHY.aspx SQL Injection Vulnerability
2. threat[32773]:NineJiaYi Management System Ajax_XT.ashx SQL Injection Vulnerability
3. threat[29719]:Qinglong Panel command-run Remote Code Execution Vulnerability
4. threat[24255]:Web Service Remote Command Execution Attack



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45917. The new/improved rules of this upgrade package are:

new rules:

1. threat[29992]:ASUS GT-AC2900 Authorization Bypass Vulnerability (CVE-2021-32030)
2. threat[29997]:CommScope Ruckus IoT Controller Access Control Error Vulnerability (CVE-2021-33221)
3. threat[29995]:WordPress plugin Social Login and Register security vulnerability (CVE-2023-2437)
4. threat[29996]:WordPress plugin GPX Viewer File Upload Vulnerability(CVE-2024-10629)
5. threat[29994]:WordPress plugin Canto security vulnerability (CVE-2023-3452)
6. threat[29993]:WordPress wps-hide-login plugin security feature bypass vulnerability (CVE-2019-15823)
7. threat[32941]:Argo CD Information Disclosure Vulnerability (CVE-2025-55190)
8. threat[32943]:itsourcecode Construction Management System SQL Injection Vulnerability (CVE-2024-50972)
9. threat[32942]:Shenke LEANMES System ChooseLineAndRes.ashx SQL Injection Vulnerability
10. threat[29998]:Wordpress Epsilon Framework Themes Unauthorized Code Injection Vulnerability (CVE-2020-36708)
11. threat[29991]:EsafeNet CDG SQL Injection Vulnerability (CVE-2024-10610)
12. threat[32939]:Yonyou KSOA SQL Injection Vulnerability (CVE-2026-1130)
13. threat[32940]:Yonyou KSOA SQL Injection Vulnerability (CVE-2026-1129)
14. threat[29999]:EsafeNet CDG SQL Injection Vulnerability (CVE-2024-10595)
15. threat[20100]:Wordpress Import XML And RSS Feeds Unauthorized Remote Code Execution Vulnerability (CVE-2023-4521)
16. threat[20101]:pgAdmin4 Remote Code Execution Vulnerability(CVE-2026-17566)


update rules:

1. threat[24578]:Zabbix Authentication Bypass Vulnerability(CVE-2019-17382)
2. threat[32925]:GeoServer jsonArrayContains Unauthorized SQL Injection Vulnerability(CVE-2026-76904)
3. threat[31806]:kkFileView getCorsFile Server Request Forgery Vulnerability (CVE-2022-43140)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45899. The new/improved rules of this upgrade package are:

new rules:

1. threat[29986]:Yonyou NC Cloud filterRefJSON Deserialization Vulnerability
2. threat[29987]:Yonyou NC IServiceEntryPoint XXE Vulnerability
3. threat[32937]:Yonyou KSOA SQL Injection Vulnerability (CVE-2026-1179)
4. threat[29988]:Yonyou KSOA SQL Injection Vulnerability (CVE-2026-1133)
5. threat[29989]:Yonyou KSOA SQL Injection Vulnerability (CVE-2026-1131)
6. threat[32938]:Yonyou KSOA SQL Injection Vulnerability (CVE-2026-1132)
7. threat[29990]:JeecgBoot Modular Report Unauthorized Remote Code Execution Vulnerability


update rules:

1. threat[41770]:ADB Debugging Interface Unauthorized Suspicious Command Execution
2. threat[42105]:Redis Suspicious File Write Behavior
3. threat[50692]:ADB Remote Debugging Interface Connection Behavior



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45879. The new/improved rules of this upgrade package are:

new rules:

1. threat[32932]:Yonyou NC Cloud personMonthSigninDetail SQL Injection Vulnerability
2. threat[32933]:Yonyou NC Cloud getStaffShift SQL Injection Vulnerability
3. threat[32934]:Tongda OA appserver_interface.php SQL Injection Vulnerability
4. threat[32935]:JeecgBoot Unauthorized Permission Bypass and SQL Injection Combined Vulnerability
5. threat[29984]:Ruijie NBR Router /local/auth/php/getCfile.php Arbitrary File Inclusion Vulnerability
6. threat[29985]:Feiqi Interconnect FE Enterprise Operation Management Platform 2.ln Privilege Bypass Vulnerability
7. threat[32936]:Dahua Smart Park Integrated Management Platform SQL Injection Vulnerability
8. threat[42848]:Striker Trojan Online



update rules:

1. threat[30860]:Tongda OA swfupload_new.php SQL injection vulnerability
2. threat[25748]:Linux Information Collection Hidden Command Execution



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45861. The new/improved rules of this upgrade package are:

new rules:

1. threat[10640]:SonicWall SMA100 Buffer Error Vulnerability(CVE-2021-20038)
2. threat[32931]:Huorong Terminal Security Management System Arbitrary File Read Vulnerability
3. threat[42849]:Striker Trojan Heartbeat


update rules:

1. threat[32215]:Apache Kafka Arbitrary File Read Vulnerability (CVE-2025-27817)
2. threat[27321]:Ivanti Endpoint Manager Code Injection Vulnerability (CVE-2021-44529)
3. threat[29981]:Redis handleClientsBlockedOnKey Remote Code Execution Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45854. The new/improved rules of this upgrade package are:

new rules:

1. threat[29971]:Yonyou KSOA del_workplan.jsp SQL Injection Vulnerability (CVE-2026-1121)
2. threat[32927]:Yonyou KSOA work_info.jsp SQL Injection Vulnerability (CVE-2026-1122)
3. threat[29972]:Yonyou KSOA work_mod.jsp SQL Injection Vulnerability (CVE-2026-1123)
4. threat[32928]:Yonyou KSOA work_report.jsp SQL Injection Vulnerability (CVE-2026-1124)
5. threat[29973]:Yonyou KSOA del_work.jsp SQL Injection Vulnerability (CVE-2026-1120)
6. threat[29974]:D-Link DIR-823X Command Injection Vulnerability (CVE-2026-1125)
7. threat[32930]:Synametrics Technologies SynaMan Information Disclosure Vulnerability(CVE-2022-22828)
8. threat[10639]:PostgreSQL Buffer Error Vulnerability (CVE-2026-14669)
9. threat[29975]:CyberArk Software Enterprise Password Vault Code Issue Vulnerability(CVE-2019-7442)
10. threat[29976]:Adobe Coldfusion Deserialization Vulnerability (CVE-2023-26359)
11. threat[29977]:WordPress Simple Membership Plugin Cross-Site Request Forgery Vulnerability (CVE-2019-14328)
12. threat[42847]:Sorry Ransomwar C2 Communication
13. threat[29978]:ESAFENET CDG SQL Injection Vulnerability(CVE-2024-10613)
14. threat[29979]:vm2 Sandbox Escape Command Injection Vulnerability (CVE‑2023‑30547)
15. threat[29982]:Yonyou NC connTest Unauthorized SSRF Vulnerability
16. threat[29980]:SPIP Saisies pour formulaire Plugin Remote Code Execution Vulnerability (CVE-2025-71243)
17. threat[29983]:Yonyou NC Arbitrary Code Execution Vulnerability


update rules:

1. threat[27171]:WordPress Icegram Express Plugin SQL Injection Vulnerability(CVE-2024-2876)
2. threat[31964]:WordPress Plugin Icegram-Express Unauthenticated SQL Injection Vulnerability(CVE-2024-4295)
3. threat[32555]:Navidrome Authentication Bypass Vulnerability (CVE-2025-27112)
4. threat[24796]:Zoho ManageEngine Deserialization Remote Code Execution Vulnerability (CVE-2020-10189)
5. threat[28124]:Parse Server SQL Injection Vulnerability (CVE-2024-39309)
6. threat[29737]:WeKnora OS MCP stdio Transmission Channel Command Injection Vulnerability (CVE-2026-30861)
7. threat[25396]:JBoss Application Server Deserialization Vulnerability(CVE-2015-7501/CVE-2013-4810/CVE-2026-20131)
8. threat[25395]:JBoss Application Server Deserialization Vulnerability(CVE-2015-7501/CVE-2013-4810/CVE-2026-20131)_3
9. threat[24847]:RPM arbitrary file operation vulnerability (CVE-2017-7501)
10. threat[25531]:Spring Framework spring-bean Remote Code Execution Vulnerability(CVE-2022-22965)
11. threat[23653]:7-Technologies Interactive Graphical SCADA System stack buffer overflow (CVE-2011-1567)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45806. The new/improved rules of this upgrade package are:

new rules:

1. threat[29967]:Postgresql Anonymizer Remote Code Execution Vulnerability (CVE-2026-9617)
2. threat[32929]:VMware Cloud Foundation Path Traversal Vulnerability (CVE-2026-59310)


update rules:

1. threat[31704]:1Panel Server Administration Control Panel SQL Injection Vulnerability(CVE-2024-39907)
2. threat[26544]:Django order_by function SQL Injection Vulnerability (CVE-2021-35042)
3. threat[31384]:IC Realtime ICIP-P2012T Unauthorized Access Vulnerability (CVE-2023-31594)
4. threat[26001]:FasterXML Jackson-databind Remote Code Execution Vulnerability(CVE-2020-9548/CVE-2020-24616)
5. threat[31505]:Simple School Managment System SQL Injection Vulnerability(CVE-2024-25305)
6. threat[28051]:Simple School Management System teacher_login.php SQL Injection Vulnerability(CVE-2024-25308/CVE-2024-25309/CVE-2024-25313)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45794. The new/improved rules of this upgrade package are:

new rules:

1. threat[29969]:Hillstone CloudView getMessageSettingAction.php Arbitrary Command Execution Vulnerability
2. threat[29970]:Flowise node-custom-function Remote Code Execution Vulnerability (CVE-2026-46442)
3. threat[29964]:EsafeNet CDG Cross-Site Scripting Vulnerability (CVE-2025-0787)
4. threat[29965]:EsafeNet CDG Cross-Site Scripting Vulnerability (CVE-2025-0790)
5. threat[29966]:EsafeNet CDG SQL Injection Vulnerability (CVE-2026-18859)
6. threat[32926]:FineReport V10 Arbitrary File Read Vulnerability


update rules:

1. threat[27387]:TEMENOS Channels Local File Contains Vulnerability(CVE-2019-14251)
2. threat[31634]:Online Book System SQL Injection Vulnerability(CVE-2024-3000)



Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate, please update on a suitable time.

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45782. The new/improved rules of this upgrade package are:

new rules:

1. threat[29958]:Qinglong Panel v2.20.1 Authentication Bypass Leads to Arbitrary File Write Vulnerability
2. threat[29960]:Nginx Remote Code Execution Vulnerability (CVE-2026-42945)_2
3. threat[29959]:Dataease Redshift JDBC Remote Code Execution Vulnerability (CVE-2026-32140)
4. threat[32922]:ESAFENET CDG V5 SQL Injection Vulnerability (CVE-2025-0793)
5. threat[29961]:ESAFENET CDG V5 SQL Injection Vulnerability (CVE-2025-0792)
6. threat[29962]:ESAFENET CDG V5 SQL Injection Vulnerability(CVE-2025-0791)
7. threat[32923]:ESAFENET CDG V5 SQL Injection Vulnerability (CVE-2025-0789)
8. threat[32924]:Esafenet CDG V5 SQL Injection Vulnerability (CVE-2025-0788)
9. threat[29963]:EsafeNet CDG V5 SQL Injection Vulnerability (CVE-2025-0786)
10. threat[32925]:GeoServer jsonArrayContains Unauthorized SQL Injection Vulnerability
11. threat[29968]:Hillstone Web Tamper Protection System Remote Command Execution Vulnerability


update rules:

1. threat[32693]:Struts2 XML External Entity Injection Vulnerability (CVE-2025-68493)(S2-069)
2. threat[32348]:Apache Fineract Path Traversal Vulnerability (CVE-2022-44635)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45764. The new/improved rules of this upgrade package are:

new rules:

1. threat[32914]:WordPress plugin FunnelKit SQL Injection Vulnerability (CVE-2024-9186)
2. threat[32913]:JeecgBoot sys/dict/loadTreeData SQL Injection Vulnerability (CVE-2026-8114)
3. threat[29952]:JD Cloud JDCOS set_iptv_info Command Injection Vulnerability(CVE-2026-7705)
4. threat[50692]:ADB Remote Debugging Interface Connection Behavior
5. threat[32916]:Metabase Unauthorized Remote SQL Injection Vulnerability (CVE-2026-72898)
6. threat[32915]:Langflow Path Traversal Vulnerability(CVE-2026-5027)
7. threat[29953]:H3C Magic BE18000 Security Vulnerability (CVE-2025-29296)
8. threat[29954]:Open Webui Arbitrary Code Execution Vulnerability (CVE-2025-64495)_2
9. threat[29955]:WWBN AVideo Command Injection Vulnerability (CVE-2023-32073)
10. threat[32917]:Wordpress Plugin Woo Inquiry SQL Injection Vulnerability (CVE-2024-7854)_2
11. threat[32918]:CSE Bookstore SQL Injection Vulnerability (CVE-2020-36112)
12. threat[32920]:Venustech Tianqing Hanma VPN Arbitrary File Read Vulnerability
13. threat[32921]:Weaver E-Cology10 Information Disclosure Vulnerability
14. threat[29957]:PageOffice Online Document Editing Control Authentication Bypass Vulnerability


update rules:

1. threat[28441]:SeaCMS admin_files.php Remote Code Execution Vulnerability(CVE-2024-42599)
2. threat[28807]:WordPress Contact Form 7 Plugin Cross-site Scripting Vulnerability(CVE-2022-0595)
3. threat[29712]:WordPress LA-Studio Element Kit for Elementor Plugin Privilege Escalation Vulnerability(CVE-2026-0920)
4. threat[29580]:n8n Remote Code Execution Vulnerability (CVE-2025-68613)
5. threat[25775]:LanDe Network O2oa Code Execution Vulnerability (CVE-2022-22916)
6. threat[31295]:Open Solutions for Education openSIS SQL Injection Vulnerability (CVE-2020-6637)
7. threat[26582]:Schneider Electric IGSS DashBoard.exe Insecure Deserialization (CVE-2023-27978)
8. threat[27320]:Palo Alto Networks PAN-OS Command Injection Vulnerability (CVE-2021-3060/CVE-2019-1579)
9. threat[27601]:PbootCMS Remote Command Execution Vulnerability (CVE-2022-32417)
10. threat[31360]:Wordpress Zoomsounds Plugin Path Traversal Vulnerability (CVE-2021-39316)
11. threat[10496]:Search Tree ALL Query of SSDP Protocol
12. threat[27438]:ZyXEL NAS Operating System Command Injection Vulnerability (CVE-2020-9054)
13. threat[31279]:Zyxel USG FLEX Path Traversal Vulnerability (CVE-2022-2030)
14. threat[26095]:DedeCMS v5.7.93 Remote Code Execution Vulnerability (CVE-2022-35516)
15. threat[25852]:H2 Console Code Injection Vulnerability (CVE-2022-23221)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is for the intrusion prevention feature library/application identification feature library upgrade package. It is only compatible with engine versions V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45714. The newly added/improved rules in this upgrade package are:

New rules:
1. Attack [29949]: Progress LoadMaster command injection vulnerability (CVE-2026-8037)
2. Attack [42846]: Alibaba Sentinel login default password vulnerability
3. Attack [29951]: Pujiang Software ESPService deserialization remote code execution vulnerability_2
4. Attack [29950]: Pujiang Software ESPService deserialization remote code execution vulnerability_1

Updated rules:
1. Attack [32056]: Drawio server-side request forgery vulnerability (CVE-2022-1815)
2. Attack [32696]: Craft CMS API SQL injection vulnerability (CVE-2024-37843)
3. Attack [32516]: Fortra GoAnywhere MFT deserialization vulnerability (CVE-2025-10035)
4. Attack [29660]: Faculty Evaluation System remote code execution vulnerability (CVE-2023-33440)

Notes:
1. After this upgrade package is applied, the engine will automatically restart to take effect. There will be no session interruption, but 3 to 5 ping packets will be lost. Please choose an appropriate time to upgrade.

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45700. The new/improved rules of this upgrade package are:

new rules:

1. threat[32911]:Gitea Arbitrary File Read Vulnerability (CVE-2026-59774)
2. threat[29938]:Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform Unrestricted File Upload Vulnerability(CVE-2026-7696)
3. threat[29937]:Acrel EEMS Enterprise Power Operation and Maintenance Cloud Platform SQL Injection Vulnerability(CVE-2026-7695)
4. threat[29939]:Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform SQL Injection Vulnerability (CVE-2026-9523)
5. threat[32912]:Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform Path Traversal Vulnerability (CVE-2026-9550)
6. threat[29943]:WordPress XSS Remote Code Execution Vulnerability(CVE-2026-64638)
7. threat[29944]:Balbooa Forms Unauthenticated Arbitrary File Upload Leading to Remote Code Execution Vulnerability (CVE-2026-56291)
8. threat[29942]:ESAFENET CDG SQL Injection Vulnerability(CVE-2025-3401)
9. threat[29940]:ESAFENET CDG SQL Injection Vulnerability (CVE-2025-3399)
10. threat[29941]:EsafeNet CDG SQL Injection Vulnerability(CVE-2025-3400)
11. threat[29945]:ESAFENET CDG SQL Injection Vulnerability(CVE-2025-1844)
12. threat[29946]:ESAFENET DSM Command Injection Vulnerability(CVE-2025-1845)
13. threat[29947]:JetBrains TeamCity XML Deserialization Command Injection Vulnerability (CVE-2026-63077)
14. threat[29948]:Weaver E-Cology10 Remote Code Execution Vulnerability _3


update rules:

1. threat[10497]:Slowhttptest slow dos tool attack
2. threat[31274]:DedeCMS Information Breach Vulnerability (CVE-2018-6910)
3. threat[25844]:GetSimple CMS Command Execution Vulnerability (CVE-2022-41544)
4. threat[32581]:WordPress AI Engine Plugin Token Leak Vulnerability (CVE-2025-11749)
5. threat[27528]:Go-fastfs /group1/upload Arbitrary File Upload Vulnerability (CVE-2023-1800)
6. threat[28548]:Ivanti Multi-Product Buffer Overflow Vulnerability (CVE-2025-0282)
7. threat[27871]:Netgear R6850/DGND3700v2 setup.cgi Command Injection Vulnerability(CVE-2024-30568)
8. threat[32758]:WordPress Web Directory Free Plugin Local File Inclusion Vulnerability(CVE-2024-3673)
9. threat[28472]:TOTOLINK disconnectVPN Command Injection Vulnerability(CVE-2024-34921)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45663. The new/improved rules of this upgrade package are:

new rules:


update rules:

1. threat[41770]:ADB Debugging Interface Unauthorized Suspicious Command Execution
2. threat[41934]:wget ELF File Download
3. threat[42179]:Suspected malicious file download
4. threat[29385]:Dataease H2 Data Source Remote Code Execution Vulnerability (CVE-2025-58748)
5. threat[28780]:TongWeb service Remote Code Execution Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45657. The new/improved rules of this upgrade package are:

new rules:

1. threat[32910]:Dahua Smart IoT Integrated Management Platform response/file Arbitrary File Read Vulnerability


update rules:

1. threat[32836]:LiteLLM SQL Injection Vulnerability(CVE-2026-42208)
2. threat[29654]:Dokploy Command Injection Vulnerability(CVE-2026-24841)
3. threat[42369]:Suspected FRP Intranet Penetration Tool QUIC Communication
4. threat[29248]:Dataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerability (CVE-2025-57773)
5. threat[29654]:Dokploy Command Injection Vulnerability(CVE-2026-24841)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45647. The new/improved rules of this upgrade package are:

new rules:

1. threat[32908]:Advantech WISE-IoTSuite/SaaS SQL Injection Vulnerability (CVE-2025-52694)
2. threat[29933]:WordPress batch remote code execution Vulnerabilities(CVE-2026-60137/CVE-2026-63030)_2
3. threat[32909]:Drupal SQL Injection Vulnerability(CVE-2026-9082)_2
4. threat[29936]:Weaver e-Cology 10 Remote Code Execution Vulnerability_1
5. threat[29934]:Weaver E-Cology10 save remote code execution Vulnerability_2


update rules:

1. threat[26073]:GitLab 16.0.0 Arbitrary File Read Vulnerability (CVE-2023-2825)
2. threat[29868]:MCP SDK Command Injection Vulnerability (CVE-2026-30623/CVE-2026-42271)
3. threat[29618]:Tencent Weknora Command Injection Vulnerability (CVE-2026-22688)
4. threat[29488]:Fortinet Fortiweb Command Injection Vulnerability (CVE-2025-58034)
5. threat[29862]:CKAN SQL Injection Vulnerability(CVE-2026-42031)
6. threat[29138]:Akamai Cloudtest XML External Entity Injection Vulnerability (CVE-2025-49493)
7. threat[27523]:Cisco Small Business RV Series Routers Operating Systems Command Injection Vulnerability (CVE-2021-1473)
8. threat[26273]:Codoforum File Upload Vulnerability (CVE-2022-31854)
9. threat[42369]:Suspected FRP Intranet Penetration Tool QUIC Communication
10. threat[29879]:LiteLLM API Key Privilege Escalation Vulnerability(CVE-2026-47101)
11. threat[32808]:Budibase Low-Code Platform Unauthorized Access Vulnerability (CVE-2026-31816)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45619. The new/improved rules of this upgrade package are:

new rules:

1. threat[32899]:Flipper Code WP Maps SQL Injection Vulnerability(CVE-2026-39492)
2. threat[29927]:JTL Software JTL Shop Code Injection Vulnerability(CVE-2026-54390)
3. threat[32901]:CmsEasy Path Traversal Vulnerability(CVE-2025-1336)
4. threat[29928]:MB Connect Line mbCONNECT24/Helmholz SQL Injection Vulnerability(CVE-2026-40836)
5. threat[32900]:MB Connect Line mbCONNECT24 SQL Injection Vulnerability (CVE-2026-40834)
6. threat[29929]:MB Connect Line mbCONNECT24/mymbCONNECT24 SQL Injection Vulnerability(CVE-2026-40833)
7. threat[29930]:JeecgBoot getDictItems SQL Injection Vulnerability(CVE-2026-3672)
8. threat[32902]:CmsEasy Path Traversal Vulnerability(CVE-2024-34315)
9. threat[32903]:CmsEasy Arbitrary File Read Vulnerability(CVE-2024-34314)
10. threat[32904]:CmsEasy Path Traversal Vulnerability(CVE-2025-1335)
11. threat[32906]:CmsEasy Path Traversal Vulnerability(CVE-2025-1106)
12. threat[32907]:CmsEasy Path Traversal Vulnerability(CVE-2025-0973)
13. threat[29931]:CmsEasy Command Execution Vulnerability(CVE-2024-32163)
14. threat[29932]:Hillstone Networks Security Isolation and Information Exchange System Multi-parameter Remote Command Execution Vulnerability
15. threat[42845]:MaLoader C2 Communication


update rules:

1. threat[28212]:Delta Electronics InfraSuite Device Master fieldExtraInfo Insecure Deserialization Vulnerability
2. threat[42841]:Dabashan camera Empty Password LogIn
3. threat[21976]:Axis2/SAP BusinessObjects Authenticated Code Execution (via SOAP) Vulnerability(CVE-2010-0219)
4. threat[26848]:Seowon Intech SWC 5100W WIMAX Bootloader Command Injection Vulnerability (CVE-2023-27826)
5. threat[28445]:Linksys E2000 Command Injection Vulnerability (CVE-2023-31740)
6. threat[26526]:rConfig Network Device SQL Injection Vulnerability(CVE-2022-45030)
7. threat[32367]:VMware HCX SQL Injection Vulnerability (CVE-2024-38814)
8. threat[32266]:sscms Arbitrary File Read Vulnerability(CVE-2025-45529)
9. threat[26271]:Fastjson 1.2.80 Deserialization Vulnerability (CVE-2022-25845)
10. threat[32697]:ComfyUI-Manager CRLF Injection Vulnerability(CVE-2026-22777)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45596. The new/improved rules of this upgrade package are:

new rules:

1. threat[29920]:Roxy-WI Command Injection Vulnerability (CVE-2022-31161)
2. threat[42838]:Monero Mining Pool Connection
3. threat[42839]:FakeSvc Mining Organization Download Payload
4. threat[42840]:FakeSvc Mining Organization Send Information
5. threat[32898]:Microweber Path Traversal Vulnerability(CVE-2026-65694)
6. threat[42841]:Dabashan camera Empty Password LogIn
7. threat[29921]:RSJoomla RSFiles Arbitrary File Upload Vulnerability(CVE-2026-57827)
8. threat[42842]:SilverFox XOR+addition+Zlib Online Communication
9. threat[42843]:SilverFox XOR+addition+Zlib Heartbeat Communication
10. threat[29923]:Apache Activemq Jolokia REST API Unauthorized Access Vulnerability (CVE-2024-32114)
11. threat[29922]:Nocobase Code Execution Vulnerability(CVE-2026-6224)
12. threat[42844]:MuddyWater HTTP_VIP Backdoor Host Registration
13. threat[29925]:Microsoft Office SharePoint Server Deserialization Injection Vulnerability (CVE-2026-50522)
14. threat[29924]:Jiusi OA OfficeServer Code Problem Vulnerability (CVE-2025-13249)
15. threat[29926]:Weaver E-Cology10 getFieldValueFun SQL Injection Vulnerability


update rules:

1. threat[31128]:YongYou NC supdoc.jsp SQL Injection Vulnerability
2. threat[42805]:BitCoinMiner Mining Pool Connection
3. threat[29909]:Fastjson 1.2.83/2 Remote Code Execution Vulnerability(CVE-2026-16723)
4. threat[28906]:HP Integrated Lights-Out 4 Remote Command Execution Vulnerability(CVE-2017-12542)
5. threat[28874]:Yonyou U8 Cloud ServiceDispatcherServlet Deserialization Vulnerability
6. threat[27166]:Seth SuccezBI front-end Arbitrary File Upload Vulnerability
7. threat[24611]:Apache Flink Dashboard Unauthorized Access - Remote Code Command Execution Vulnerability
8. threat[42558]:MuddyWater Phoenix Backdoor C2 Communication
9. threat[23589]:Mongodb Unauthorized Access Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45538. The new/improved rules of this upgrade package are:

new rules:

1. threat[32892]:dotCMS SQL Injection Vulnerability (CVE-2026-8054)
2. threat[42831]:Dysphoria Botnet Login/Heartbeat
3. threat[42832]:Dysphoria Botnet FTP Communication
4. threat[42833]:Dysphoria Botnet Relay Node Status Chekin
5. threat[32893]:Hangzhou Jiuqi Technology BigAnt Instant Messaging System getFileTrueAddress SQL Injection Vulnerability
6. threat[32894]:Vite Path Traversal Vulnerability (CVE-2026-39365)
7. threat[42834]:Fbot Botnet Login/Heartbeat
8. threat[42835]:Fbot Botnet Telnet Scan
9. threat[29917]:FreeScout Input Validation Error Vulnerability(CVE-2026-53595)
10. threat[29916]:Qiyuesuo Electronic Signing Platform Createbyfile Remote Code Execution Vulnerability
11. threat[42836]:SilverFox AnonymousRat Download Login Module
12. threat[32895]:Dahua ICC Intelligent IoT Management Platform viewPDF Arbitrary File Read Vulnerability


update rules:

1. threat[29774]:Langflow build_public_tmp Remote Code Execution Vulnerability(CVE-2026-33017)
2. threat[28205]:Harbor Permission Permission And Access Control Issue Vulnerability (CVE-2019-16097)
3. threat[42413]:XWiki Platform Open Redirect Vulnerability (CVE-2023-32068)
4. threat[32062]:Travelpayouts Redirection Vulnerability(CVE-2024-0337)
5. threat[28039]:PrestaShop Responsive Mega Menu Pro Remote Command Execution Vulnerability(CVE-2018-8823)
6. threat[25377]:Gitlab Server-Side Request Forgery(SSRF) Vulnerability(CVE-2021-22214)
7. threat[27534]:D-Link DSL-3782 Command Injection Vulnerability (CVE-2023-27216)
8. threat[29717]:Langflow Remote Code Execution Vulnerability (CVE-2026-0770)
9. threat[67457]:MySQL Null Password Authentication Bypass
10. threat[24257]:Spring Framework isWritableProperty SpEL Injection Vulnerability(CVE-2018-1273)
11. threat[29909]:Fastjson 1.2.83/2 Remote Code Execution Vulnerability(CVE-2026-16723)
12. threat[31274]:DedeCMS Information Breach Vulnerability (CVE-2018-6910)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is for the intrusion prevention feature library/application identification feature library upgrade package. It is only compatible with engine versions V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, while the rule version becomes 2.0.0.45491. The new/improved rules added/improved in this upgrade package are:
New rules:
1. Attack [29915]: The file upload vulnerability in the BigAnt instant messaging system of Hangzhou Jiugui Technology - admin/Upload/upload
2. Attack [32888]: The SQL injection vulnerability in the Jinhe OA nextselectplan.aspx
3. Attack [32889]: The SQL injection vulnerability in the Yonyou U8Cloud MARosterPhotoServlet
4. Attack [32890]: The SQL injection vulnerability in the admin/secret/edit of the BigAnt instant messaging system of Hangzhou Jiugui Technology
5. Attack [32891]: The SQL injection vulnerability in the clearUserDevice of the BigAnt instant messaging system of Hangzhou Jiugui Technology
6. Attack [42828]: The remote control Trojan SparkRAT's Websocket communication
7. Attack [42829]: The remote control Trojan SparkRAT's HTTP communication
8. Attack [10637]: The heap out-of-bounds write vulnerability in Redis RedisBloom TDigest
9. Attack [42830]: The download of Payload by the ChainVeil malware

Update Rules:
1. Attack [31034]: Remote file reading vulnerability in Xiaomi router (CVE-2019-18371)
2. Attack [26248]: Remote code execution vulnerability in Struts2 (CVE-2012-0391/CVE-2012-0392/CVE-2012-0393/CVE-2012-0394) (S2-008)
3. Attack [29683]: Remote code execution vulnerability in Langflow CSV Agent (CVE-2026-27966)
4. Attack [30855]: File download vulnerability in Gateone (CVE-2020-35736)
5. Attack [42003]: Input validation error vulnerability in Revive Adserver (CVE-2021-22873)
6. Attack [42824]: Exception in HTTP protocol Header field
7. Attack [23708]: Multiple open redirection vulnerabilities in Apache Struts (CVE-2013-2248) (S2-017)
8. Attack [32086]: Server-side request forgery vulnerability in WordPress Paytm Payment Gateway plugin (CVE-2022-45362)
9. Attack [25761]: Identity authentication bypass vulnerability in Fortinet firewall (CVE-2022-40684)
10. Attack [32030]: Server request forgery vulnerability in Red Hat Keycloak (CVE-2020-10770)

Notes:
1. After installing this upgrade package, the engine will automatically restart and take effect. There will be no session interruption. However, 3 to 5 ping packets may be lost. Please choose an appropriate time to upgrade.

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45469. The new/improved rules of this upgrade package are:

new rules:

1. Attack [29910]: There is a remote command execution vulnerability in the invoke interface of Panwei E-cology 10
2. Attack [32881]: There is an SQL injection vulnerability in the upload of Panwei E-cology 10
3. Attack [42820]: The task is issued by Baihuo KongRat
4. Attack [42821]: The C2 communication of Baihuo KongRat
5. Attack [32882]: Security vulnerability of OpenSTAManager (CVE-2026-35168)
6. Attack [32883]: Unauthorized information leakage vulnerability of Gitea (CVE-2026-27771)
7. Attack [32884]: File_download arbitrary file reading vulnerability in Dahua ICC intelligent IoT management platform
8. Attack [29911]: Code injection vulnerability of QNAP Systems Malware Remover (CVE-2025-11837)
9. Attack [32886]: SQL injection vulnerability of MikroORM (CVE-2026-44680)
10. Attack [32887]: SQL injection vulnerability of PbootCMS (CVE-2018-19893)
11. Attack [32885]: Path traversal vulnerability of Boa wapopen (CVE-2017-9833)
12. Attack [29912]: Command execution vulnerability of PbootCMS (CVE-2018-19595)
13. Attack [42823]: C2 communication of XWorm V2
14. Attack [29913]: Remote code execution through deserialization of Joomla SP LMS (CVE-2026-48909)
15. Attack [42824]: Exception in HTTP protocol Header field
16. Attack [29914]: Command execution vulnerability of PbootCMS v1.3.2
17. Attack [42825]: Online of CHAOS remote control Trojan
18. Attack [42826]: Sending host information by CHAOS remote control Trojan
19. Attack [42827]: WebSocket communication of CHAOS remote control Trojan


update rules:

1. threat[29909]:Fastjson 1.2.83 Remote Code Execution Vulnerability
2. threat[25702]:Realtek Jungle SDK OS Command Injection Vulnerability (CVE-2021-35394)
3. threat[27601]:PbootCMS Remote Command Execution Vulnerability (CVE-2022-32417)
4. threat[32491]:Xinzhongxin Campus Card Management System ProductInfoJF SQL Injection Vulnerability
5. threat[32680]:Dahua ICC Intelligent IoT Management Platform list Interface SQL Injection Vulnerability
6. threat[24418]:KindEditor editor file upload vulnerability(CVE-2017-1002024)
7. threat[32728]:Redis Server info information leakage
8. threat[66197]:Oracle WebLogic Server HTTP Cookie Buffer Overflow Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45416. The new/improved rules of this upgrade package are:

new rules:

1. threat[29905]:Cisco Identity Services Engine Command Injection Vulnerability (CVE-2026-20180)
2. threat[32879]:ColdFusion Path Traversal Vulnerability (CVE-2026-27305)
3. threat[42819]:Apache APISIX Dashboard Unauthorized Access Vulnerability(CVE-2021-45232)
4. threat[29906]:Microsoft Office SharePoint Server Deserialization Vulnerability (CVE-2026-45484)
5. threat[32880]:Discuz! admincp.php Information Disclosure Vulnerability
6. threat[29907]:Discuz! Cross-Site Scripting Vulnerability(CVE-2022-45543)
7. threat[29908]:WordPress batch remote code execution Vulnerabilities(CVE-2026-60137/CVE-2026-63030)
8. threat[29909]:Fastjson 1.2.83 Remote Code Execution Vulnerability


update rules:

1. threat[24192]:Apache CouchDB _config Command Execution Vulnerability(CVE-2017-12636)
2. threat[28184]:Smartlink Cloud Mining System testService SQL injection vulnerability
3. threat[41544]:Trojan/Backdoor General JSP trojan Files Upload
4. threat[29431]:Jinhe OA ImportGuide2Xml.aspx XML External Entity Injection(XXE) Vulnerability
5. threat[26599]:Atlassian Confluence Permission Bypass Vulnerability(CVE-2023-22518)
6. threat[28222]:Yonyou U8-Cloud uapbd.refdef.query SQL Injection Vulnerability
7. threat[24841]:Jboss Unauthorized Access Vulnerability (CVE-2010-0738)
8. threat[28507]:Barracuda CloudGen WAN Command Injection Vulnerability (CVE-2023-26213)
9. threat[29000]:Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2024-27778)
10. threat[28194]:Yonyou U8-Cloud system esnserver Arbitrary File Upload Vulnerability
11. threat[50672]:Todesk Remote Control Tool Connection Establishment Behavior
12. threat[24835]:Discuz! ML RCE Vulnerability (CVE-2019-13956)
13. threat[23589]:Mongodb Unauthorized Access Vulnerability
14. threat[24315]:Zoho ManageEngine OpManager FailOverHelperServlet Cross-Site Scripting(CVE-2018-12998)
15. threat[31397]:IceWarp Mail Server Directory Traversal Vulnerability (CVE-2023-39699)
16. threat[31423]:LG Simple Editor Directory Traversal Vulnerability (CVE-2023-40496)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45376. The new/improved rules of this upgrade package are:

new rules:

1. threat[29893]:ColdFusion Arbitrary File Upload Leading to Code Execution Vulnerability (CVE-2026-48276)
2. threat[42814]:ARS VBS Loader C2 Connect
3. threat[42815]:CoreWarrior RAT C2 Communication
4. threat[32872]:ColdFusion Arbitrary File Read Vulnerability (CVE-2026-48313)
5. threat[29894]:OpenSTAManager Arbitrary File Upload Vulnerability (CVE-2026-38751)
6. threat[29896]: KindLink livevod/forward Interface SSRF Vulnerability
7. threat[29895]:ColdFusion Arbitrary File Write Vulnerability (CVE-2026-48282)
8. threat[29898]:Control Web Panel CWP SQL Injection Vulnerability (CVE-2026-57517)
9. threat[29897]:Nanhao Online Grading System Monitor Interface Unauthorized Access Vulnerability
10. threat[42816]:SDBbot RAT C2 Communication
11. threat[42817]:Get2 Downloader Send Host Information
12. threat[32873]:XWiki Platform Path Traversal Vulnerability (CVE-2026-34151)
13. threat[29899]:OvisLink AirLive cgi_test.cgi Command Injection Vulnerability(CVE-2015-2279)
14. threat[42818]:StealC Stealer v2 C2 Communication
15. threat[29901]:Citrix NetScaler ADC/Gateway Memory Overflow Vulnerability (CVE-2025-7775)
16. threat[29900]:OvisLink AirLive wireless_mft.cgi Command Injection Vulnerability(CVE-2014-8389)
17. threat[32874]:Crocus System DeviceFileReport.do Any File Read Vulnerability
18. threat[32875]:Ovislink AirLive WL-2600CAM Directory Traversal Vulnerability(CVE-2013-3541)
19. threat[32877]:Xunrao Technology X2Modbus Gateway GetUser Information Disclosure Vulnerability
20. threat[29903]:X2Modbus Gateway DeleteUser Arbitrary User Deletion Vulnerability
21. threat[32876]:Ovislink Airlive WL-2600CAM IP Camera Information Disclosure Vulnerability(CVE-2013-3686)
22. threat[32878]:Gogs Information Disclosure Vulnerability(CVE-2026-52815)
23. threat[29904]:Redis Unauthorized Access obtain Remote server permission Vulnerability(CNVD-2015-07557)_2
24. threat[29902]:Microsoft SharePoint Server Reflected Cross-Site Scripting Vulnerability(CVE-2026-45465)


update rules:

1. threat[26517]:Delta Industrial Automation DIAEnergie SQL Injection Vulnerability(CVE-2022-41773)
2. threat[31093]:Tornado Directory Traversal Vulnerability (CVE-2023-25265)
3. threat[25166]:AirLink101 SkyIPCam1620W Remote Command Execution Vulnerability(CVE-2015-2280)
4. threat[31113]:Tongda OA result.php SQL Injection Vulnerability
5. threat[32360]:ICEcoder Arbitrary File Read Vulnerability (CVE-2024-41373)
6. threat[29086]:BentoML runner Server Remote Code Execution Vulnerability(CVE-2025-32375)
7. threat[26871]:DrayTek Vigor 2960 Router Command Injection Vulnerability (CVE-2023-24229)
8. threat[28888]:ZoneMinder Remote Command Execution Vulnerability (CVE-2023-26035)
9. threat[41904]:Hidden Command Execution Attack
10. threat[29469]:TongWeb ejbserver/ejb Insecure Deserialisation Vulnerability
11. threat[29180]:Ivanti Endpoint Manager SQL Injection Vulnerability (CVE-2024-32840)
12. threat[27290]:SourceCodester Inventory Management System SQL Injection Vulnerability (CVE-2024-1926)
13. threat[28007]:Yonyou U8-Cloud AddTaskDataRightAction SQL Injection Vulnerability
14. threat[28008]:Yonyou U8-Cloud MultiRepChooseAction SQL Injection Vulnerability
15. threat[32728]:Redis Server info information leakage
16. threat[28052]:Yisetong LogDownLoadService SQL Injection Vulnerability
17. threat[31112]:Wanhu OA downloadhttp.jsp Arbitrary File Download Vulnerability
18. threat[31118]:Tongda OA get_file.php Arbitrary File Reading Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45316. The new/improved rules of this upgrade package are:

new rules:

1. threat[42806]:Amadey Trojan Send Victim Host Information
2. threat[42807]:Amadey Trojan Delivery Cryptominer
3. threat[42808]:Remus Stealer Online
4. threat[42809]:Remus Stealer Send Stolen InformationStealer Send Stolen Information
5. threat[29889]:n8n Prototype Pollution Leading to Remote Code Execution Vulnerability (CVE-2026-44789)
6. threat[42810]:Lumma Stealer v6 C2 Connect
7. threat[42811]:Lumma Stealer v6 Send Stolen Information
8. threat[29890]:Provectus kafka-ui Code Injection Vulnerability (CVE-2026-5562)
9. threat[29891]:Flowise process Arbitrary File Write Vulnerability(CVE-2025-71338)
10. threat[29892]:Ivanti Sentry handleMessage Command Injection Vulnerability(CVE-2026-10520/CVE-2026-10523)
11. threat[42812]:Prometheus Unauthorized Access
12. threat[42813]:OceanLotus APT Load SpectralViper Backdoor


update rules:

1. threat[42538]:Amadey Trojan Online
2. threat[28522]:dst-admin Command Injection Vulnerability (CVE-2023-0648)
3. threat[42222]:Lumma Stealer Trojan Negotiating Configuration Information
4. threat[42792]:SpectralViper Backdoor C2 Communication
5. threat[25148]:FasterXML jackson-databind Remote Code Execution Vulnerability(CVE-2020-36179/CVE-2020-36180/CVE-2020-36181/CVE-2020-36182)
6. threat[25946]:Redis Shell Reverse Command Execution
7. threat[42086]:Silver Fox XOR+ Subtraction Encrypted Communication
8. threat[25451]:Adobe Acrobat DC SMask Out of Bounds Write Vulnerability(CVE-2021-39843)
9. threat[27875]:Yonyou U8cloud BusinessRefAction SQL Injection Vulnerability
10. threat[26104]:ASUS RT-N53 Router Command Execution Vulnerability(CVE-2022-31874)
11. threat[32364]:lmxcms Directory Traversal Vulnerability (CVE-2023-23136)
12. threat[27917]:Yonyou NC System FileManager Arbitrary File Upload Vulnerability
13. threat[42601]:Bitter Loads Malicious Documents
14. threat[27930]:Weaver e-cology BlogService SQL Injection Vulnerability
15. threat[41770]:ADB Debugging Interface Unauthorized Suspicious Command Execution
16. threat[29394]:BentoML 1.4.3 Deserialization Vulnerability(CVE-2025-27520/CVE-2024-2912)
17. threat[28523]:dst-admin Command Injection Vulnerability (CVE-2023-0649)
18. threat[42505]:BITTER ArtraDownloader C2 Communication_2
19. threat[42227]:BITTER ArtraDownloader Stealing Information Of Victimized Hosts



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45266. The new/improved rules of this upgrade package are:

new rules:

1. threat[32869]:YesWiki SQL Injection Vulnerability (CVE-2026-46670)
2. threat[29880]:Joomla Content Editor (JCE) Remote Code Execution Vulnerability (CVE-2026-48907)
3. threat[29881]:UniFi OS Improper Access Control Vulnerability (CVE-2026-34908)
4. threat[29882]:Xinuos Openserver Command Injection Vulnerability (CVE-2020-25494)
5. threat[29883]:TP-Link TL-WR849N cgi Command Injection Vulnerability(CVE-2020-9374)
6. threat[29884]:BMC FootPrints VIEWSTATE Deserialisation Vulnerability(CVE-2025-71260)
7. threat[32870]:Jenkins XStream Deserialization Arbitrary File Read Vulnerability (CVE-2026-53435)
8. threat[42800]:Vidar Stealer Send Victim Host Information
9. threat[42801]:Vidar Stealer Send Stolen Information
10. threat[42802]:Vidar Stealer Send Plugins Information
11. threat[32871]:Nezha Monitoring Dashboard Path Traversal Vulnerability(CVE-2026-53519)
12. threat[29885]:JoomShaper SP Page Builder File Upload Vulnerability (CVE-2026-48908)
13. threat[42803]:Citeary Worm HTTP Communication
14. threat[29886]:Crawl4AI gi_frame.f_back AST sandbox escape Vulnerability(CVE-2026-53753)
15. threat[42804]:Suspected Malicious File Download Command_TCP
16. threat[29887]:Gogs Git organisation name path traversal leads to a Git hooks overwrite vulnerability(CVE-2026-52813)
17. threat[42805]:BitCoinMiner Mining Pool Connection
18. threat[29888]:Orkes Conductor Unauthorized Remote Code Execution Vulnerability (CVE-2026-58138)


update rules:

1. threat[28520]:dst-admin Command Injection Vulnerability (CVE-2023-0646)
2. threat[28606]:WordPress Backuply Plugin SQL Injection Vulnerability (CVE-2024-8669)
3. threat[27556]:Datang Telecom NVS3000 Integrated Video Surveillance Platform getDepResList SQL Injection Vulnerability
4. threat[32018]:Argus Surveillance DVR Directory Traversal Vulnerability (CVE-2018-15745)
5. threat[32213]:LYNX Twonky Server Directory Traversal Vulnerability (CVE-2018-7171)
6. threat[27717]:Ruisikanda-Multi-service Intelligent Gateway list_base_config.php Remote Command Execution Vulnerability(CVE-2024-7120)
7. threat[27686]:Tongda OA get_columns.php SQL Injection Vulnerability
8. threat[42602]:Suspected Malicious File Download _2
9. threat[25475]:Apache Log4j2 Remote Code Execution Vulnerability(CVE-2021-44228/CVE-2021-45046)
10. threat[27740]:Jin Wanwei Cloud Connection Application System Access Platform GNRemote.dll Remote Command Execution Vulnerability
11. threat[27243]:D-Link DIR-816 A2 Command Injection Vulnerability (CVE-2022-42999)
12. threat[28514]:Delta Electronics DVW-W02W2-E2 Command Injection Vulnerability (CVE-2022-42139)
13. threat[32409]:MasaCMS Directory Traversal Vulnerability (CVE-2021-42183)
14. threat[32423]:Sonicwall SMA100 Directory Traversal Vulnerability (CVE-2021-20034)
15. threat[42626]:Suspected Malicious File Download Command_UDP
16. threat[27604]:Ivanti EPM SQL Injection Vulnerability (CVE-2024-29824)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45209. The new/improved rules of this upgrade package are:

new rules:

1. threat[42792]:SpectralViper Backdoor C2 Communication
2. threat[29878]:Dell Unity OS Command Injection Vulnerability (CVE-2025-36604)
3. threat[29877]:Apache Activemq Jolokia Remote Code Execution Vulnerability (CVE-2026-42588)
4. threat[50682]:Netease UU Remote Control Tool Communication Behavior
5. threat[50683]:N-Able N-Central Cloud Nodes Remote Control Communication Behavior
6. threat[50684]:i4 Remote Control Tool Communication Behavior
7. threat[29876]:ZCKX Introduction.ashx Any File Upload Vulnerability(CVE-2024-33786)
8. threat[42793]:Weaxor Ransomware Send Victim Host Information
9. threat[42794]:Mallox Ransomware C2 Communication
10. threat[32867]:LMDeploy Framework Server-Side Request Forgery (SSRF) Vulnerability(CVE-2026-33626)
11. threat[29879]:LiteLLM API Key Privilege Escalation Vulnerability(CVE-2026-47101)
12. threat[32866]:Hengan Weighing Management Information Query Platform SQL Injection Vulnerability(CVE-2024-33787)
13. threat[42795]:DcRat C2 Server Authentication
14. threat[10636]:Redis Use-After-Free Vulnerability (CVE-2026-23631)
15. threat[42796]:Aisuru Botnet Online
16. threat[42797]:Gafgyt Botnet Variant C0XMO Handshake
17. threat[32868]:XunRuiCMS Information Disclosure Vulnerability(CVE-2023-1680)
18. threat[42798]:Gafgyt Botnet Variant C0XMO Command Handler
19. threat[42799]:VoidLoader Malicious HTTP Communication


update rules:

1. threat[26889]:Dahua DSS Digital Monitoring System itcBulletin SQL Injection Vulnerability
2. threat[25748]:Linux Information Collection Hidden Command Execution
3. threat[25740]:Linux Shell Reverse Hidden Command Execution
4. threat[49049]:Discovering CrackMapExec-smbexec remote command execution behavior
5. threat[42179]:Suspected malicious file download
6. threat[32841]:Grafana Unauthorized Access Vulnerability
7. threat[27178]:Tenda WriteFacMac Command Injection Vulnerability (CVE-2018-16334/CVE-2022-31446/CVE-2024-10697/CVE-2024-41473)
8. threat[28214]:Netgear Orbi Router RBR750 Command Injection Vulnerability (CVE-2022-37337)
9. threat[41499]:HTTP Request Sensitive Path Access Attempt-System Sensitive Files
10. threat[27015]:Yonyou U8 Cloud BlurTypeQuery SQL injection Vulnerability
11. threat[29143]:Yonyou KSOA del_user SQL injection vulnerability
12. threat[29146]:Nbeasy Online Customer Service System Remote Code Execution Vulnerability
13. threat[27136]:Yonyou NC/U8 ActionServlet SQL injection Vulnerability
14. threat[27515]:UFIDA NC Cloud IMetaWebService4BqCloud SQL Injection Vulnerability
15. threat[42751]:SilverFox Farfli Trojan Downloader



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45151. The new/improved rules of this upgrade package are:

new rules:

1. threat[32865]:Splunk Enterprise Unauthorized Arbitrary File Operation Vulnerability (CVE-2026-20253)
2. threat[32862]:IBM Bigfix Platform Information Leakage Vulnerability (CVE-2019-4061)
3. threat[32863]:Gitlab CE/EE Information Leakage Vulnerability (CVE-2022-0735)
4. threat[29870]:SolarWinds Web Help Desk Security Control Bypass Vulnerability (CVE-2025-40536)
5. threat[10635]:Fortinet FortiWeb Out-of-Bounds Write Vulnerability (CVE-2026-40688)
6. threat[29871]:Kubernetes Ingress-Nginx Remote Code Execution Vulnerability (CVE-2025-24514)
7. threat[29872]:MLflow jobs Unauthorized Access Vulnerability (CVE-2026-0545)
8. threat[42787]:MonoGlyphRAT Trojan C2 Request
9. threat[42788]:MonoGlyphRAT Trojan Send Host Infomation
10. threat[42789]:TriStealer Trojan C2 Communication
11. threat[42790]:UTG-Q-015 CertficateTools Backdoor C2 Communication
12. threat[29873]:Windows Netlogon Remote Code Execution Vulnerability (CVE-2026-41089)
13. threat[29874]:Nginx Proxy Manager dns_provider_credentials Authentication Remote Code Execution Vulnerability(CVE-2026-40519)
14. threat[42791]:VoidLink Malicious HTTP Communication
15. threat[32864]:EduSoho Education and Training System classropm-course-statistics Arbitrary File Read Vulnerability(CNVD-2023-03903)
16. threat[29875]:Microsoft SharePoint Path Traversal Vulnerability (CVE-2026-45454)


update rules:

1. threat[26892]:Hongfan OA list interface SQL Injection Vulnerability
2. threat[32365]:Langchain-Chatchat upload_temp_docs Path Traversal Vulnerability(CVE-2025-6853)
3. threat[27295]:YonYou GRP-U8 operOriztion SQL Injection Vulnerability
4. threat[31112]:Wanhu OA downloadhttp.jsp Arbitrary File Download Vulnerability
5. threat[26902]:Wanhu OA iSignatureHTML.jsp SQL Injection Vulnerability
6. threat[26313]:AnHeng Mingyu Security Gateway And Many Other Manufacturers sslvpn Command Execution Vulnerability(CNVD-2023-03898)
7. threat[42600]:XWorm RAT C2 Communication
8. threat[26328]:Dahua Smart Park Comprehensive Management Platform searchJson SQL Injection Vulnerability
9. threat[28936]:TOTOLINK NR1800X Command Injection Vulnerability (CVE-2022-41518/CVE-2022-44249/CVE-2022-44250/CVE-2022-44251/CVE-2023-37145)
10. threat[28511]:Tenda AC1200 Command Injection Vulnerability (CVE-2022-42053)
11. threat[26858]:Yonyou U8 cloud KeyWordDetailReportQuery SQL injection Vulnerability
12. threat[29093]:Nagios XI Command Injection Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45102. The new/improved rules of this upgrade package are:

new rules:

1. threat[32850]:Open WebUI Access Control Error Vulnerability(CVE-226-45397)
2. threat[32851]:Microsoft SharePoint Server Reflected Cross-Site Scripting Vulnerability(CVE-2026-20959)
3. threat[32852]:E-Learning System SQL Injection Vulnerability(CVE-2021-3239)
4. threat[29864]:Microsoft SharePoint Remote Code Execution Vulnerability(CVE-2025-62204)
5. threat[29865]:Letta-ai letta Remote Code Execution Vulnerability(CVE-2026-4965)
6. threat[29866]:MindsDB files Path Traversal Vulnerability(CVE-2026-27483)
7. threat[32854]:FastGPT getTools Server-Side Request Forgery(SSRF)Vulnerability(CVE-2026-34163/CVE-2026-34162)
8. threat[42781]:Lazarus APT Download Malicious Payload
9. threat[42782]:Lazarus APT Copperhedge Backdoor C2 Communication
10. threat[42783]:Lazarus APT Manuscrypt Backdoor C2 Communication
11. threat[42784]:SilentRunLoade Backdoor C2 Communication
12. threat[29867]:FreePBX Unauthorized Access Leading to Remote Code Execution Vulnerability (CVE-2025-57819)
13. threat[32855]:Open WebUI edit Server-Side Request Forgery(SSRF)Vulnerability(CVE-2026-34225)
14. threat[32856]:Fumeng Cloud CRM AjaxFormDefault.ashx SQL Injection Vulnerability
15. threat[32857]:Fumeng Cloud CRM AjaxOrderManage.ashx SQL Injection Vulnerability
16. threat[32858]:Fumeng Cloud CRM AjaxMailSetup.ashx SQL Injection Vulnerability
17. threat[32859]:Fumeng Cloud CRM AjaxProductionTask.ashx SQL Injection Vulnerability
18. threat[29868]:MCP SDK Command Injection Vulnerability (CVE-2026-30623/CVE-2026-42271)
19. threat[32860]:OpenEMR Post-Authentication Arbitrary File Read Vulnerability (CVE-2026-24849)
20. threat[42785]:AsyncRAT Trojan TLS Communication
21. threat[29869]:NginxUI MCP Interface Authentication Bypass Vulnerability (CVE-2026-33032)
22. threat[42786]:HTTP Request Access Attempts To Sensitive Paths_Common Business Log Files
23. threat[42778]:PureRAT C2 Communication


update rules:

1. threat[32521]:lollms-webui Arbitrary File Deletion Vulnerability (CVE-2024-9597)
2. threat[32786]:SonicWall SMA100 radiusChallengeLogin Reflected Cross-Site Scripting Vulnerability(CVE-2025-40598)
3. threat[32660]:Label Studio Cross-Site Scripting (XSS) Vulnerability(CVE-2025-47783/CVE-2025-25296)
4. threat[50676]:Operations on Sensitive Commands in PostgreSQL Databases
5. threat[29268]:VMware Workspace One Access and VMware Identity Manager SQL Injection Vulnerability (CVE-2022-31659)
6. threat[28392]:Tenda AX1803/1806 Command Injection Vulnerability (CVE-2022-34596/CVE-2022-34597)
7. threat[26819]:Struts2 Remote Code Execution Vulnerability(CVE-2023-50164)(S2-066)_2
8. threat[27150]:Java Code Execution (Request Body)
9. threat[10139]:Linux Kernel SNMP NAT Helper Remote Denial of Service Vulnerability(CVE-2006-2444)
10. threat[23597]:Redis Unauthorized Access obtain Remote server permission Vulnerability(CNVD-2015-07557)
11. threat[29867]:FreePBX Unauthorized SQLi Access Leading to Remote Code Execution Vulnerability (CVE-2025-57819)
12. threat[26654]:Inductive Automation Ignition Deserialization Vulnerability(CVE-2022-35870)
13. threat[27244]:D-Link DIR-816 Command Injection Vulnerability (CVE-2022-37125)
14. threat[27264]:D-Link DIR-816/816 Command Injection Vulnerability (CVE-2022-37129/CVE-2022-34974)
15. threat[41821]:ABPTTS Tunnel Communication
16. threat[25475]:Apache Log4j2 Remote Code Execution Vulnerability(CVE-2021-44228/CVE-2021-45046)
17. threat[32756]:Advantech iView NetworkServlet getNextTrapPage SQL Injection Vulnerability(CVE-2025-53475)
18. threat[24255]:Web Service Remote Command Execution Attack



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.45066. The new/improved rules of this upgrade package are:

new rules:

1. threat[42765]:HTTP Service Directory Traversal Vulnerability - Directory Traversal via Request Body
2. threat[32845]:DataEase Remote Code Execution Vulnerability(CVE-2025-49003)
3. threat[42779]:Mirai tuxnokill Variant Download
4. threat[42780]:Hadoop Datanode JMX Interface UnAuthorized Access
5. threat[32846]:XWiki Platform Cross-Site Scripting Vulnerability(CVE-2026-40105)
6. threat[29855]:AstrBot Directory Traversal Upload Vulnerability(CVE-2025-57698)
7. threat[29856]:Microsoft Windows IKEv2 Fragment Reassembly Double Free Vulnerability(CVE-2026-33824)
8. threat[32847]:Microsoft Windows Shell Link Information Leak Vulnerability(CVE-2026-25185)
9. threat[29854]: XWiki Platform Distribution Flavor Main Cross-Site Scripting Vulnerability(CVE-2026-24128)
10. threat[32848]:BentoML process_image Server-Side Request Forgery(SSRF)Vulnerability(CVE-2025-54381)
11. threat[29858]:AstrBot MCP Code Execution Vulnerability(CVE-2026-6118)
12. threat[29859]:Delta Electronics DIALink Directory Traversal Authentication Bypass Vulnerability(CVE-2025-58320)
13. threat[29857]:rConfig Server-Side Request Forgery Vulnerability(CVE-2023-39110)
14. threat[29861]:Cisco Secure Firewall Management Center Identity Bypass Vulnerability(CVE-2026-20079)
15. threat[29860]:LiteLLM Sandbox Escape and Code Execution Vulnerability(CVE-2026-40217)
16. threat[32849]:Cpanel&WHM Arbitrary File Reading Vulnerability (CVE-2026-29205)
17. threat[29862]:CKAN SQL Injection Vulnerability(CVE-2026-42031)
18. threat[29863]:Microsoft Windows NTLM Spoof Vulnerability(CVE-2026-21249)


update rules:

1. threat[32520]:XWiki Path Traversal Vulnerability (CVE-2025-55748/CVE-2026-23734)
2. threat[32595]:XWiki Path Traversal Vulnerability (CVE-2025-55747)
3. threat[32424]:Progress WhatsUp Gold SnmpExtendedActiveMonitor Directory Traversal Vulnerability(CVE-2024-12105)
4. threat[26832]:Sunhillo SureLine Command Injection Vulnerability(CVE-2021-36380)
5. threat[24255]:Web Service Remote Command Execution Attack
6. threat[42766]:SilverFox WinOS Download Malicious Payload
7. threat[32421]:Ivanti Endpoint Manager serverMemory loadModuleTable SQL Injection Vulnerability(CVE-2024-34779)
8. threat[27213]:SiteServer CMS File Upload Vulnerability (CVE-2021-42654)
9. threat[29307]:ShowDoc Arbitrary File Upload Vulnerability (CVE-2021-36440)
10. threat[27256]:Multiple D-Link Command Injection Vulnerabilities (CVE-2021-45382)
11. threat[24154]:Intel Active Management Technology Remote Privilege Escalation Vulnerability(CVE-2017-5689)
12. threat[60464]:HTTP Directory Traversal Vulnerability
13. threat[27135]:NETGEAR ProSafe SSL VPN firmware FVS336G SQL Injection Vulnerability (CVE-2022-29383)
14. threat[28938]:D-Link DIR-820L Command Injection Vulnerability (CVE-2022-26258)
15. threat[32771]:rConfig Server-Side Request Forgery Vulnerability(CVE-2023-39108/CVE-2023-39109)
16. threat[50676]:Postgresql sensitivity instruct operation



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.44984. The new/improved rules of this upgrade package are:

new rules:

1. threat[42769]:VRED Clusterservice Control Panel Unauthorized Access
2. threat[32844]:Drupal SQL Injection Vulnerability(CVE-2026-9082)
3. threat[42773]:GhostPenguin Backdoor Connecting To C2 Server
4. threat[29852]:Yonyou NC System IMsgCenterWebService SQL Injection Vulnerability
5. threat[29853]:rConfig SQL Injection Vulnerability (CVE-2020-10546)
6. threat[42774]:APT37 Rustonotto Backdoor C2 Communication
7. threat[42775]:APT37 Chinotto Backdoor C2 Communication
8. threat[42776]:APT37 AblyGo Backdoor C2 Communication
9. threat[42770]:MongoDB Operator JavaScript Injection
10. threat[42771]:MongoDB MapReduce Operation JavaScript Injection
11. threat[50680]:MongoDB system.js Persistent operation
12. threat[42772]:MongoDB Aggregation Pipeline Operator JavaScript Injection
13. threat[50681]:MongoDB eval Command Call Behavior
14. threat[42770]:MongoDB $where Operator JavaScript Injection
15. threat[42772]:MongoDB Aggregation Pipeline $function Operator JavaScript Injection
16. threat[29845]:MineAdmin Enterprise-Level Backend Management System: Hard-Coded Management Permissions Key Vulnerability(CVE-2026-1195)
17. threat[29846]:MineAdmin Enterprise-Level Backend Management System Command Execution Vulnerability (CVE-2025-65854)


update rules:

1. threat[29633]:Gridx Remote Command Execution Vulnerability (CVE-2020-19625)
2. threat[28857]:Xunyi Technology 74cms SQL Injection Vulnerability (CVE-2020-22210)
3. threat[60464]:HTTP Directory Traversal Vulnerability
4. threat[31510]:HTTP SQL Injection Attempt(Other)
5. threat[49014]:DNS domain name query for mining pool servers
6. threat[32749]:Atlassian Jira Unauthorized Information Leak Vulnerability (CVE-2019-8446)
7. threat[31473]:Allegra GanttAndSchExportAction Directory Traversal Vulnerability(CVE-2023-22361)
8. threat[28447]:HTTP Python Code Execution Type Two
9. threat[27006]:Milespight VPN Arbitrary File Read Vulnerability(CVE-2023-23907)
10. threat[25748]:Linux Information Collection Hidden Command Execution
11. threat[42312]:Cobalt Strike TaoWu Reverse HTTP C2 Communication
12. threat[31149]:Citrix Gateway Open Redirection and XSS Vulnerability(CVE-2023-24488)
13. threat[26300]:CloudExplorer Lite Command Injection Vulnerability(CVE-2023-38692)
14. threat[41534]:Web Page Contains Mining Script Code
15. threat[25496]:WordPress Query SQL Injection Vulnerability(CVE-2022-21661)
16. threat[42454]:Suspected HTTP Requests Exists XSS Injection Common Event Function
17. threat[42484]:Suspected HTTP Requests Exists XSS Script Injection tag
18. threat[23277]:Suspected HTTP Requests Exists XSS Injection Call Browser Objects and Methods
19. threat[24502]:Suspected HTTP Requests Exists XSS Injection JavaScript pseudo-protocol invocation
20. threat[42604]:Suspected HTTP Requests Exists XSS Injection in Vue Framework
21. threat[42148]:Godzilla Webshell Connection
22. threat[28131]:XWiki.org XWiki SearchAdmin Code Injection Vulnerability(CVE-2023-50721)
23. threat[23597]:Redis Unauthorized Access obtain Remote server permission Vulnerability(CNVD-2015-07557)
24. threat[26485]:Gila CMS Arbitrary File Upload Vulnerability (CVE-2020-28692)
25. threat[42777]:HTTP Directory Traversal - Request Parameters
26. threat[30708]:ManageEngine ServiceDesk DownloadFileServlet Information Disclosure(CVE-2017-11511)
27. threat[30834]:Seeyon A8 status.jsp Information Disclosure Vulnerability
28. threat[31180]:Bank Locker Management System Cross-Site Scripting Vulnerability(CVE-2023-0563)
29. threat[42147]:HTTP Sensitive Parameters Execute Arbitrary Command Attempt
30. threat[26830]:Cisco IOS XE Web UI Elevation of Privilege Vulnerability(CVE-2023-20198)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.44888. The new/improved rules of this upgrade package are:

new rules:
1. threat[42762]:PrivateLoader C2 Communication
2. threat[29850]:Claude Code Deep Link Command Injection Vulnerability
3. threat[32840]:Open WebUI config Unauthorized Vulnerability (CVE-2025-63391)
4. threat[32841]:Grafana Unauthorized Access Vulnerability
5. threat[42766]:SilverFox WinOS Download Malicious Payload
6. threat[32842]:React Component Remote Code Execution Vulnerability Detection(CVE-2025-55182)
7. threat[32843]:Docker Registry API Unauthorized Access Vulnerability
8. threat[42767]:Suspicious activity involving the creation or modification of administrator accounts in PostgreSQL
9. threat[42768]:Suspicious behavior of PostgreSQL create event triggers

update rules:
1. threat[31707]:Citrix ShareFile StorageZones Arbitrary File Read Vulnerability(CVE-2020-8982)
2. threat[30894]:Visual Slide Box Builder 3.2.9 SQL Injection Vulnerability(CVE-2022-1182)
3. threat[31642]:WordPress plugin NotificationX suffers from sql injection vulnerability(CVE-2024-1698)
4. threat[28683]:WordPress Plugin Elementor File Upload Vulnerability(CVE-2023-48777)
5. threat[31695]:ShengQiao ERP System SingleRowQueryConvertor SQL Injection Vulnerability(CVE-2024-13979)
6. threat[28114]:Delta Electronics DIAEnergie GetDIAE_astListParameters SQL Injection Vulnerability(CVE-2024-28040)
7. threat[28116]:Delta Electronics DIAEnergie GetDIAE_slogListParameters SQL Injection Vulnerability(CVE-2024-23975)
8. threat[28117]:Delta Electronics DIAEnergie GetDIAE_unListParameters SQL Injection Vulnerability(CVE-2024-23494)
9. threat[28118]:Delta Electronics DIAEnergie GetDIAE_usListParameters SQL Injection Vulnerability(CVE-2024-25574)
10. threat[28087]:Shibang Communications IP Network Intercom Broadcasting System my_parser.php Arbitrary File Upload Vulnerability(CVE-2024-31680)
11. threat[28727]:Edimax IC-7100 IP Camera Command Inject Vulnerability(CVE-2025-1316)
12. threat[29765]:TOTOLINK X2000R formWsc command injection(CVE-2025-5504)
13. threat[42226]:BITTER Steal Files With Specific Extensions
14. threat[42232]:BITTER asms Trojan Send Stolen Message
15. threat[23597]:Redis Unauthorized Access obtain Remote server permission Vulnerability(CNVD-2015-07557)
16. threat[28891]:Totolink Routers X5000R and A7000R Command Injection Vulnerability(CVE-2022-27004)
17. threat[26000]:FasterXML jackson-databind Remote Code Execution Vulnerability(CVE-2020-36188/CVE-2020-36189)
18. threat[29619]:FasterXML Jackson-databind JdbcRowSetImpl Remote Code Execution Vulnerability
19. threat[26005]:FasterXML Jackson-databind Remote Code Execution Vulnerability(CVE-2020-14195)
20. threat[26462]:WordPress Metform Elementor Plugin form-data.php Stored Cross-Site Scripting(CVE-2023-0084)
21. threat[29093]:Nagios XI Command Injection Vulnerability
22. threat[29221]:Progress LoadMaster Command Injection Vulnerability (CVE-2024-56131)
23. threat[29515]:React Server Components Remote Code Execution Vulnerability (CVE-2025-55182/CVE-2025-66478)
24. threat[31216]:Suspected XXL-JOB Server-Side Request Forgery Vulnerability (CVE-2022-43183)
25. threat[25731]:Linux Sample Download Hidden Command Execution
26. threat[42608]:MYSQL Ransomware Text Insertion Behavior
27. threat[41770]:ADB Debugging Interface Suspicious Command Execution
28. threat[42602]:Suspected Malicious File Download _2
29. threat[32022]:SpringCloud Eureka Unauthorized Access Vulnerability
30. threat[24811]:Apache Solr Velocity Remote Code Execution Vulnerability (CVE-2019-17558)
31. threat[28655]:WordPress iThemes Security (better-wp-security) Plugin SQL injection vulnerability (CVE-2018-12636)
32. threat[28272]:Tenda AC15 AC1900 Operating System Command Injection Vulnerability(CVE-2020-15916)

Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.44837. The new/improved rules of this upgrade package are:

new rules:

1. threat[29835]:Android ADB TLS Authentication Bypass Vulnerability (CVE-2026-0073)
2. threat[29836]:Ollama GGUF Heap Out-of-Bounds Read Vulnerability(CVE-2026-7482)
3. threat[42755]:Attempts to access sensitive paths via HTTP requests_Common Business Sensitive Documents
4. threat[42754]:Attempt to Access Sensitive Paths via HTTP Requests-Application Components
5. threat[42756]:SimpleHelp Directory Traversal Vulnerability (CVE-2024-57727)_1
6. threat[29837]:Grafana SQL Expressions Remote Code Execution Vulnerability (CVE-2026-27876)
7. threat[42757]:Moonrise RAT WebSocket Communication
8. threat[42758]:Multiple instances of unauthorized access in the KuaFu Panel's mdserver-web
9. threat[29838]:Totolink A7100RU setStorageCfg Command Injection Vulnerability(CVE-2026-5976)
10. threat[29839]:Totolink A7100RU setVpnPassCfg Command Injection Vulnerability(CVE-2026-5850)
11. threat[29841]:Totolink A7100RU setIpv6LanCfg Command Injection Vulnerability(CVE-2026-5853)
12. threat[29842]:Totolink A7100RU setWiFiEasyCfg Command Injection Vulnerability(CVE-2026-5854)
13. threat[29840]:Totolink A7100RU setIptvCfg Command Injection Vulnerability(CVE-2026-5852)
14. threat[29844]:WordPress Plugin Contact Form by Supsystic Template Injection Vulnerability (CVE-2026-4257)
15. threat[42759]:Myth Stealer Online
16. threat[29843]:llama.cpp RPC service remote code execution Vulnerability(CVE-2026-34159)
17. threat[42760]:Myth Stealer Send Stolen Infomation
18. threat[29848]:Nginx Remote Code Execution Vulnerability (CVE-2026-42945)
19. threat[29849]:LiteLLM Jinja2 SSTI Remote Code Execution Vulnerability(CVE-2026-42203)
20. threat[29847]:marimo Unauthorized Access Vulnerability (CVE-2026-39987)
21. threat[42761]:XRed Backdoor Obtain Dynamic DNS


update rules:

1. threat[31678]:JeecgBoot_Teaching Online Learning Platform getDictItemsByTable SQL Injection Vulnerability(CVE-2024-10546)
2. threat[31356]:Zfsoft ReportServer Arbitrary File Read Vulnerability
3. threat[10582]:Django get_supported_language_variant Denial Of Service Attack (CVE-2024-39614)
4. threat[31238]:Alibaba Nacos Default AccessToken Login Vulnerability(CVE-2021-43116)
5. threat[28420]:Struts2 Remote Code Execution Vulnerability(CVE-2024-53677)(S2-067)
6. threat[28424]:Struts2 Remote Code Execution Vulnerability(CVE-2024-53677)(S2-067)_1
7. threat[41499]:HTTP Request Sensitive Path Access Attempt-System-Sensitive Files
8. threat[29750]:Zabbix Visible Name SQL Injection Vulnerability(CVE-2025-27240)
9. threat[41719]:FUCKYOU Suspicious network activity
10. threat[25006]:Apache Shiro Authentication Bypass Vulnerability (CVE-2020-1957)
11. threat[68655]:Suspicious Webshell Backdoor Access and Control
12. threat[62203]:HTTP Command Injection Attempt
13. threat[29245]:SMTP Protocol Command Injection Behavior
14. threat[68220]:Webshell Sample 100727 Upload
15. threat[68657]:Suspicious Webshell Script Files Upload Behavior_5
16. threat[62201]:HTTP SQL Injection Attempt (Boolean blind injection)
17. threat[42454]:Suspected HTTP Requests Exists XSS Injection Common Event Function
18. threat[32139]:LyLme Spage SQL Injection Vulnerability (CVE-2023-45951)
19. threat[26788]:Wavlink WL-WN535K2_K3 command injection vulnerability (CVE-2022-2486)
20. threat[25707]:Sangfor EDR c.php Remote Code Execution Vulnerability(CNVD-2020-46552)
21. threat[42146]:HTTP request parameters carry suspected command injection payloads
22. threat[32338]:Hongfan IOffice Intelligent Office System MobileOA.asmx SQL Injection Vulnerability
23. threat[23725]:Glassfish Directory Traversal Vulnerability(CVE-2017-1000028)
24. threat[63362]:Cross Site Scripting Vulnerability(HTTP)
25. threat[28734]:Hadoop YARN REST API Unauthorized Access Vulnerability
26. threat[24904]:HP LinuxKI 6.01Remote Command Injection Vulnerability(CVE-2020-7209)
27. threat[24101]:Apache Tomcat Remote Code Execution Vulnerability(CVE-2017-12615/CVE-2017-12617)
28. threat[42611]:Redis Suspicious Configuration File Modification Behavior
29. threat[23277]:Web Service Cross-Site Scripting
30. threat[60993]:HTTP Cross Site Generic Scripting Attempt
31. threat[60991]:HTTP Request XSS Cross Site Scripting Attempt
32. threat[60992]:HTTP Request Params Cross Site Scripting Type Attemp
33. threat[63697]:HTTP Cross Site Scripting Vulnerability
34. threat[60467]:Generic HTTP Cross Site Scripting Type Attempt
35. threat[24515]:Seeyon OA Collaboration Software A6/A8 Arbitrary File Upload Vulnerability
36. threat[26427]:Telos Alliance Omnia MPX Node Information Leakage Vulnerability(CVE-2022-36642)
37. threat[31510]:HTTP SQL Injection Attempt(Other)
38. threat[31121]:HTTP SQL Injection Attempt (Database Fingerprinting Detection)
39. threat[42484]:Suspected HTTP Requests Exists XSS Script Injection tag
40. threat[23888]:Microsoft Edge Scripting Engine Remote Memory Corruption Vulnerability(CVE-2016-7190)(MS16-119)
41. threat[28563]:Microsoft Windows VBScript Engine Remote Code Execution(CVE-2018-8373)
42. threat[62105]:HTTP Directory Traversal - Encoding Bypass
43. threat[28811]:Liferay Portal Deserialization Vulnerability(CVE-2019-16891)
44. threat[28272]:Tenda AC15 AC1900 Operating System Command Injection Vulnerability(CVE-2020-15916)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.44831. The new/improved rules of this upgrade package are:

new rules:

1. threat[29848]:Nginx Remote Code Execution Vulnerability (CVE-2026-42945)
2. threat[29849]:LiteLLM Jinja2 SSTI Remote Code Execution Vulnerability(CVE-2026-42203)
3. threat[29847]:marimo Unauthorized Access Vulnerability (CVE-2026-39987)
4. threat[42761]:XRed Backdoor Obtain Dynamic DNS


update rules:

1. threat[26427]:Telos Alliance Omnia MPX Node Information Leakage Vulnerability(CVE-2022-36642)
2. threat[31510]:HTTP SQL Injection Attempt(Other)
3. threat[31121]:HTTP SQL Injection Attempt (Database Fingerprinting Detection)
4. threat[42484]:Suspected HTTP Requests Exists XSS Script Injection tag



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.44743. The new/improved rules of this upgrade package are:

new rules:
1. threat[42749]:SilverFox Delivery gh0st Trojan
2. threat[32836]:LiteLLM SQL Injection Vulnerability(CVE-2026-42208)
3. threat[29832]:Microsoft SharePoint Workflow Unsafe Reflection Vulnerability(CVE-2025-49701)
4. threat[42750]:VanTom Remote Control Trojan Communication Behavior
5. threat[42752]:Nginx ngx_http_dav_module Buffer Overflow Vulnerability (CVE-2026-27654)
6. threat[42751]:SilverFox ValleyRAT C2 Communication
7. threat[42753]:Pulsar RAT C2 Communication
8. threat[28417]:NetMizer log management system hostipreport remote command execution vulnerability
9. threat[29833]:Apache ActiveMQ Classic Remote Code Execution Vulnerability (CVE-2026-41044)
10. threat[32837]:OpenCode content Arbitrary File Read Vulnerability
11. threat[29834]:cPanel/WHM Authentication Bypass Vulnerability(CVE-2026-41940)

update rules:
1. threat[25354]:phpMyadmin Scripts/setup.php Deserialization Vulnerability(CVE-2010-3055)
2. threat[25702]:Realtek Jungle SDK OS Command Injection Vulnerability (CVE-2021-35394)
3. threat[41336]:Remote Control Tool PSEXEC Establish Connections
4. threat[24676]:Intellian Aptus Web Remote Code Execution Vulnerability (CVE-2020-7980)
5. threat[31510]:HTTP SQL Injection Attempt(Other)
6. threat[31121]:HTTP SQL Injection Attempt (Database Fingerprinting Detection)
7. threat[32150]:HTTP SQL Injection Attempt (Sql Computation/Encoding)
8. threat[29652]:WordPress wpDiscuz Plugin File Upload Vulnerability (CVE-2020-24186)
9. threat[28191]:NetMizer Log Management System position.php Command Execution Vulnerability
10. threat[27717]:Ruisikanda-Multi-service Intelligent Gateway list_base_config.php Remote Command Execution Vulnerability(CVE-2024-7120)
11. threat[32477]:Ollama File Existence Disclosure Vulnerability(CVE-2024-39719)
12. threat[28192]:NetMizer Log Management System hostdelay.php Command Execution Vulnerability
13. threat[28857]:Xunyi Technology 74cms SQL Injection Vulnerability (CVE-2020-22210)
14. threat[25129]:Apache Unomi Remote Code Execution Vulnerability(CVE-2020-13942)
15. threat[28847]:modoboa Email Management Platform Improper Authorization Vulnerability (CVE-2023-2227)
16. threat[29245]:SMTP Protocol Command Injection Behavior
17. threat[24196]:Microsoft Edge type confusion vulnerability(CVE-2018-0775)
18. threat[26444]:Cacti graph_view.php SQL injection vulnerability(CVE-2023-39361)
19. threat[28395]:C-DATA Web Management System Operating System Command Injection Vulnerability (CVE-2022-4257)
20. threat[31883]:WordPress Order Listener for WooCommerce Plugin SQL Injection Vulnerability(CVE-2022-0948)
21. threat[32264]:elFinder Local File Inclusion Vulnerability(CVE-2022-26960)
22. threat[26985]:Exrick XMall SQL Injection Vulnerability(CVE-2024-24112)
23. threat[31642]:WordPress plugin NotificationX suffers from sql injection vulnerability(CVE-2024-1698)
24. threat[31462]:Fortra FileCatalyst SQL injection vulnerability (CVE-2024-5276)
25. threat[27321]:Ivanti Endpoint Manager Code Injection Vulnerability (CVE-2021-44529)
26. threat[29231]:Rclone Command Injection Vulnerability (CVE-2026-41179)
27. threat[27513]:Apache Camel Remote Code Execution Vulnerability(CVE-2026-40453)
28. threat[25277]:Linksys tmUnblock.cgi ttcp_ip Remote Code Execution Vulnerability(CNVD-2014-01260)
29. threat[26385]:Dahua Smart Park Comprehensive Management Platform DevicePoint_AddImgIco File Upload Vulnerability(CVE-2023-3836)
30. threat[31762]:Xsstrike Cross-Site Scripting Vulnerability Scanning Tool
31. threat[25124]:PHPJabbers Appointment Scheduler 2.3 - Reflected XSS Vulnerability(CVE-2020-35416)
32. threat[26830]:Cisco IOS XE Web UI Elevation of Privilege Vulnerability(CVE-2023-20198)
33. threat[25565]:Apache APISIX batch-requests Remote Code Execution Vulnerability (CVE-2022-24112)
34. threat[25676]:Gogs Git Endpoints Directory Traversal Vulnerability(CVE-2022-1993)
35. threat[28843]:Langflow Remote Code Execution Vulnerability(CVE-2025-3248/CVE-2025-57760)
36. threat[29195]:Apache HTTP Server Tomcat Remote Directory Access Vulnerability(CVE-2007-0450)
37. threat[31222]:kkFileView getCorsFile Arbitrary File Reading Vulnerability(CVE-2021-43734)
38. threat[30787]:Swagger Sensitive Information Disclosure Vulnerability
39. threat[42462]:Discover Server-Side Request ForgeryBypass Attack Behavior
40. threat[30886]:Atlassian Jira Unauthorized Access Vulnerability (CVE-2019-8442)
41. threat[25951]:Atlassian Jira Arbitrary File Reading Vulnerability(CVE-2021-26086)
42. threat[60464]:HTTP Directory Traversal Vulnerability
43. threat[32268]:NetMizer Log Management System Terminal SQL Injection Vulnerability
44. threat[26003]:FasterXML Jackson-databind Remote Code Execution Vulnerability(CVE-2020-24750)
45. threat[26004]:FasterXML Jackson-databind Remote Code Execution Vulnerability(CVE-2020-10673)


Announcements:
1. After update the package, the engine will restart automatically, this will don't interrupt sessions, but will cause 3-5 packets loss on ping opereate", please update on a suitable time.

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.44666. The new/improved rules of this upgrade package are:

new rules:

1. threat[29827]:Jellyfin Remote Code Execution Vulnerability (CVE-2026-35031)
2. threat[29828]:Netgate pfSense CE Suricata package Stored Cross-Site Scripting Vulnerability (CVE-2025-34178)
3. threat[42748]:SilverFox Trojan RC4+Base64 Communication
4. threat[32835]:Fumeng Cloud CRM CustomizeReportSelectMould.aspx SQL Injection Vulnerability
5. threat[29829]:Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-39808)
6. threat[29830]:Redis XACKDEL command Stack Buffer Overflow Vulnerability(CVE-2025-62507)
7. threat[29831]:NineJiaYi ERP PicUploadIMG.ashx Arbitrary File Upload Vulnerability


update rules:

1. threat[25460]:Microsoft Edge_Chakra__array_prototype_concat_Type_Confusion Vulnerability(CVE-2016-7242)
2. threat[23888]:Microsoft Edge Scripting Engine Remote Memory Corruption Vulnerability(CVE-2016-7190)(MS16-119)
3. threat[24001]:Microsoft Edge Remote Memory Corruption Vulnerability(CVE-2017-0227)
4. threat[27079]:Ray DashBoard API Unauthorized Command Execution Vulnerability(CVE-2023-48022/CVE-2025-62593)
5. threat[23365]:Microsoft Internet Explorer CVE-2015-0032 Remote Memory Corruption Vulnerability
6. threat[66093]:Microsoft Internet Explorer HtmlLayout Remote Code Execution Vulnerability
7. threat[23600]:Microsoft Internet Explorer Memory Corruption Vulnerability(CVE-2015-6084)(MS15-112)
8. threat[23943]:Microsoft Browser Memory Corruption By Encode Confusion
9. threat[31971]:ActiveMQ Information Disclosure Vulnerability(CVE-2017-15709)
10. threat[23835]:Microsoft Internet Explorer Remote Memory Corruption Vulnerability(CVE-2016-3288)(MS16-095)
11. threat[23481]:Microsoft Internet Explorer CVE-2015-1742 Remote Memory Corruption Vulnerability
12. threat[23855]:Microsoft VBScript Remote Memory Corruption Vulnerability(CVE-2016-3375)
13. threat[42329]:HTTP request headers carry suspected command injection payloads
14. threat[23822]:Microsoft Internet Explorer and Edge Remote Memory Corruption Vulnerability(CVE-2016-3259)(MS16-084/85)
15. threat[25839]:Node.js Command Injection Vulnerability(CVE-2021-21315)
16. threat[28764]:Kubernetes ingress-nginx Remote Code Execution Vulnerability (CVE-2025-1974)
17. threat[26001]:FasterXML Jackson-databind Remote Code Execution Vulnerability(CVE-2020-9548/CVE-2020-24616)
18. threat[26002]:FasterXML Jackson-databind Remote Code Execution Vulnerability(CVE-2020-9547)
19. threat[24725]:FasterXML jackson-databind JNDI Injection Remote Code Execution Vulnerability(CVE-2020-8840)
20. threat[25771]:ThinkPHP multilingual function Remote Code Execution Vulnerability(CVE-2022-47945)
21. threat[25489]:Apache httpd mod_proxy Unix Socket Server-Side Request Forgery Vulnerability (CVE-2021-40438)
22. threat[63656]:Axios HTTP Header Injection Leads To Cloud Metadata Leakage Vulnerability (CVE-2026-40175)
23. threat[26305]:Sangfor Application Delivery Reporting System Remote Command Execution Vulnerability
24. threat[42146]:HTTP request parameters carry suspected command injection payloads
25. threat[41719]:FUCKYOU Suspicious network activity
26. threat[24777]:Squid Proxy HTTP Host Buffer Overflow Vulnerability(CVE-2020-8450)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.44616. The new/improved rules of this upgrade package are:

new rules:

1. threat[29817]:Microsoft SharePoint Workflow Insecure Deserialization Vulnerability(CVE-2025-49712)
2. threat[29818]:Node.js Exploit Prototype Chain Pollution Hijack Local Socket and Communicate with Docker Interface Attempt
3. threat[29819]:Netgate pfSense snort_sid_mgmt.php sidlist_name Directory Traversal Vulnerability
4. threat[29820]:Apache Tomcat Deserialization Remote Code Execution Vulnerability (CVE-2026-34486)
5. threat[29823]:Cockpit Remote Command Injection Vulnerability (CVE-2026-4631)
6. threat[29824]:Cockpit Remote Command Injection Vulnerability (CVE-2026-4631)_1
7. threat[32834]:Windows Snipping Tool Spoofing Vulnerability Vulnerability(CVE-2026-33829)
8. threat[32833]:Feroxbuster Web Scanning Tool


update rules:

1. threat[27324]:Netflix Genie path traversal vulnerability (CVE-2024-4701)
2. threat[23943]:Microsoft Browser Memory Corruption By Encode Confusion
3. threat[23821]:Microsoft Edge ASLR Security Bypass Vulnerability(CVE-2016-3244)(MS16-085)
4. threat[32456]:AgentScope Path Traversal Vulnerability(CVE-2024-8438)
5. threat[23933]:Microsoft Internet Explorer and Edge Font Lang Parameter Use After Free(CVE-2016-3297)
6. threat[23874]:Microsoft Edge Scripting Engine Remote Code Execution Vulnerability(CVE-2016-7189)
7. threat[27128]:OpenMetadata Command Execution Vulnerability (CVE-2024-28255)
8. threat[27553]:QNAP Remote Code Execution Vulnerability(CVE-2024-27130)
9. threat[27526]:Rejetto HTTP File Server Remote Code Execution Vulnerability (CVE-2024-23692)
10. threat[28311]:Centreon Web insertGraphTemplate SQL Injection Vulnerability(CVE-2024-23119)
11. threat[26460]:XWiki.org XWiki.UIExtensionClass Code Injection Vulnerability(CVE-2023-35166)
12. threat[23751]:Microsoft Edge Memory Corruption Vulnerability(CVE-2016-0124)(MS16-024)
13. threat[25435]:Apache HTTP Server Directory Traversal Vulnerability(CVE-2021-41773/CVE-2021-42013)
14. threat[25336]:Microsoft Internet Explorer Memory Corruption Vulnerability(CVE-2021-26411)
15. threat[31966]:Streamlit directory traversal vulnerability(CVE-2022-35918)
16. threat[25444]:Flarum Stored Core Cross-Site Scripting Vulnerability(CVE-2021-32671)
17. threat[25445]:Flarum Reflected Core Cross-Site Scripting Vulnerability(CVE-2021-32671)
18. threat[28033]:Byzoro Smart S85F Management Platform Command injection vulnerability (CVE-2023-5683)
19. threat[41499]:HTTP Request Sensitive Path Access Attempt
20. threat[27055]:Voltronic Power ViewPower Pro autoMatchMac Command Injection Vulnerability(CVE-2023-51572)
21. threat[26724]:Zimbra Autodivers XXE External Entity Injection Vulnerability(CVE-2019-9670)
22. threat[24255]:Web Service Remote Command Execution Attack
23. threat[26980]:Cacti Group Cacti poller_host_duplicate SQL Injection Vulnerability(CVE-2023-49085)
24. threat[23135]:GNU Bash Environment Variables Remote Command Execution(CVE-2014-6271)
25. threat[26976]:Zoho ManageEngine RecoveryManager Plus updateProxySettings Command Injection Vulnerability(CVE-2023-48646)
26. threat[23824]:Microsoft Edge and Internet Explorer Information Disclosure Vulnerability(CVE-2016-3277)(MS16-084/85)
27. threat[23820]:Microsoft Internet Explorer Remote Memory Corruption Vulnerability(CVE-2016-3241)(MS16-084)
28. threat[28058]:F5 BIG-IP Remote Code Execution Vulnerability (CVE-2023-46747)_2
29. threat[22052]: PHP-CGI Remote source leakage and Arbitrary Code Execution Vulnerability(CVE-2012-1823/CVE-2013-4878/CVE-2012-2336/CVE-2012-2311)_1
30. threat[23009]: PHP-CGI Remote source leakage and Arbitrary Code Execution Vulnerability(CVE-2012-1823/CVE-2013-4878/CVE-2012-2336/CVE-2012-2311)
31. threat[27814]:PHP/SANGFOR Desktop Cloud Report Center Remote Code Execution Vulnerability(CVE-2024-4577)
32. threat[22735]:PHP/SANGFOR Desktop Cloud Report Center Remote Code Execution Vulnerability(CVE-2024-4577)_1
33. threat[25879]:GLPI Asset Management Software Arbitrary Code Injection Vulnerability (CVE-2022-35914)
34. threat[26701]:Expression Injection Attack-Expression Evaluation
35. threat[24195]:Browser CPU Spectre vulnerability(CVE-2017-5753 and CVE-2017-5715)
36. threat[26596]:Inductive Automation Ignition ParameterVersionJavaSerialization Insecure Deserialization Vulnerability(CVE-2023-39475)
37. threat[27205]:Apache Kafka UI Command Injection Vulnerability (CVE-2023-52251)
38. threat[41770]:Malicious code spreads using ADB debugging interface
39. threat[27032]:Netgear ProSAFE NMS300 UpLoadServlet Unrestricted File Upload Vulnerability(CVE-2023-38098)
40. threat[26628]:Ivanti Avalanche FileStoreConfig validateFileStoreUncPath Arbitrary File Upload Vulnerability(CVE-2023-28128)
41. threat[31255]:Fortinet FortiOS path Traversal Vulnerability (CVE-2018-13379)
42. threat[24365]:ThinkPHP 5.x Remote Command Execution Vulnerability(CNVD-2018-24942/CVE-2018-20062)
43. threat[26971]:Barco WePresent file_transfer.cgi Code Execution Vulnerability (CVE-2019-3929)
44. threat[27517]:WordPress Plugin Waiting SQL Injection Vulnerability(CVE-2023-28659)
45. threat[27518]:WordPress Plugin Events Made Easy SQL Injection Vulnerability(CVE-2023-28660)
46. threat[27998]:WordPress Plugin WP Popup Banners SQL Injection Vulnerability (CVE-2023-28661)
47. threat[28001]:WordPress Plugin Formidable PRO2PDF SQL Injection Vulnerability (CVE-2023-28663)
48. threat[26199]:nginxWebUI runCmd Remote Command Execution Vulnerability (CVE-2024-3740)
49. threat[29245]:SMTP Protocol Command Injection Behavior
50. threat[27296]:WordPress Ultimate Member SQL Injection Vulnerability(CVE-2024-1071)
51. threat[27099]:WordPress LayerSlider plugin SQL injection vulnerability (CVE-2024-2879)
52. threat[27377]:Apache HugeGraph-Server Remote Command Execution In Gremlin(CVE-2024-27348)
53. threat[31574]:Tongda Office Anywhere SQL Injection Vulnerability(CVE-2024-25320)
54. threat[28329]:Apache Drill XML Format Plugin XML External Entity Injection Vulnerability(CVE-2023-48362)
55. threat[27999]:WordPress Plugin Gift Cards SQL Injection Vulnerability (CVE-2023-28662)
56. threat[27519]:GeoServer Attribute Name Expression Foreground Code Execution Vulnerability(CVE-2024-36401/CVE-2024-36404)
57. threat[24800]:FIBARO System Home Center 5.021 Remote File Include Vulnerability
58. threat[27494]:PGAdmin4 Deserialization Code Execution Vulnerability(CVE-2024-2044)
58. threat[28474]:Websocket information collection command execution_1



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.44529. The new/improved rules of this upgrade package are:

new rules:

1. threat[32832]:Vite WebSocket Arbitrary File Read Vulnerability (CVE-2026-39363)
2. threat[29809]:Apache ActiveMQ Jolokia Remote Code Execution Vulnerability (CVE-2026-34197)
3. threat[29810]:SKTMAX LEAN MES System UploadHander.ashx Arbitrary File Upload Vulnerability
4. threat[42641]:Suspicious UNC path read activity in MSSQL databases
5. threat[29811]:Ivanti Endpoint Manager Path Traversal Leading to Command Execution Vulnerability (CVE-2025-9713)
6. threat[29812]:Adobe ColdFusion Directory Traversal Vulnerability (CVE-2025-61808)
7. threat[29813]:Ivanti EPMM Operating System Command Injection Vulnerability (CVE-2025-10985)
8. threat[42642]:Modifying CLR security permissions in an MSSQL database is a risky practice
9. threat[42643]:Suspicious CLR Stored Procedure Binding Behavior in MSSQL Databases
10. threat[29814]:Progress ShareFile Storage Zone Controller File Upload Leads to Remote Code Execution Vulnerability (CVE-2026-2701)
11. threat[29815]:Progress ShareFile Storage Zone Controller Authentication Bypass Vulnerability (CVE-2026-2699)
12. threat[42645]:SilverFox Trojan New Variant Aes Encrypted Communication
13. threat[42644]:Suspicious Java Class Operations in the Oracle Database
14. threat[42646]:Suspicious behavior in the Oracle Database Execution Scheduler
15. threat[42647]:SilverFox Trojan XOR+addition+subtraction+shift+Zlib Encrypted Communication
16. threat[29816]:Microsoft SharePoint Server Term Store SQL injection vulnerability (CVE-2026-20947)
17. threat[42648]:Suspicious Delayed Injection Operations in Oracle Databases


update rules:

1. threat[27956]:Nystudio107 Seomatic Code Injection Vulnerability (CVE-2021-41749)
2. threat[27210]:XWiki.org XWiki SearchSuggestSourceSheet Code Injection Vulnerability(CVE-2024-31465)
3. threat[26611]:CraftCMS Remote Code Execution Vulnerability (CVE-2023-41892)
4. threat[29591]:React Server Components Remote Code Execution Vulnerability (CVE-2025-55182/CVE-2025-66478)_2
5. threat[23824]:Microsoft Edge and Internet Explorer Information Disclosure Vulnerability(CVE-2016-3277)(MS16-084/85)
6. threat[23821]:Microsoft Edge ASLR Security Bypass Vulnerability(CVE-2016-3244)(MS16-085)
7. threat[25669]:Yonyou CHANJET T+ Upload.aspx Arbitrary File Upload Vulnerability(CNNVD-202209-001)(CNVD-2022-60632)
8. threat[26275]:Hikvision Comprehensive Security Management Platform files Arbitrary File Upload Vulnerability(CVE-2023-53691)(CNVD-2022-88855)
9. threat[23853]:Microsoft Edge Remote Memory Corruption Vulnerability(CVE-2016-3294)
10. threat[26496]:PHP imap Remote Command Execution Vulnerability(CVE-2018-19518)
11. threat[29088]:VMware vRealize Network Insight Command Injection Vulnerability (CVE-2022-31702)
12. threat[25233]:Weaver OA uploadOperation.jsp Arbitrary File Upload
13. threat[41966]:Godzilla JAVA_AES_RAW Webshell Connect_3
14. threat[23746]:Microsoft Internet Explorer Memory Corruption Vulnerability(CVE-2016-0111)(MS16-023)
15. threat[24197]:Microsoft Edge Scripting Engine Memory Corruption Vulnerability(CVE-2018-0758)
16. threat[31583]:Tongda OA SQL Injection Vulnerability(CVE-2024-10656)
17. threat[30899]:GeoServer SQL Injection Vulnerability (CVE-2023-25157)
18. threat[23908]:Edge_Chakra__array_prototype_concat_Type_Confusion Vulnerability(CVE-2016-7242)
19. threat[23798]:Microsoft Edge Content Security Policy Bypass Vulnerability(CVE-2016-3198)(MS16-068)
20. threat[25558]:ZZZCMS Remote Code Execution Vulnerability (CVE-2021-32605/CVE-2019-9041)
21. threat[23964]:Microsoft Edge Information Disclosure Vulnerability(CVE-2016-7206)(MS16-145)
22. threat[28382]:Progress WhatsUp Gold AppProfileImport Unrestricted File Upload Vulnerability(CVE-2024-5008)
23. threat[27092]:WP Visitor Statistics SQL Injection Vulnerability(CVE-2023-0600)
24. threat[28384]:Progress WhatsUp Gold GetFileWithoutZip Directory Traversal Vulnerability(CVE-2024-4885)
25. threat[31245]:VoIPmonitor SQL Injection Vulnerability (CVE-2022-24260)
26. threat[28333]:Ivanti Avalanche Remote Control Server deleteSkin Directory Traversal Vulnerability(CVE-2024-38652)
27. threat[25573]:WordPress Photo Gallery Plugin filter_tag SQL Injection Vulnerability(CVE-2022-1281)
28. threat[24797]:PHPUnit Remote Code Execution Vulnerability(CVE-2017-9841)
29. threat[26204]:WordPress plugin BackupBuddy Arbitrary File Read Vulnerability (CVE-2022-31474)
30. threat[28385]:QNAP Multiple Products privWizard.cgi username Command Injection Vulnerability(CVE-2024-32766)
31. threat[25491]:MeterSphere Remote Code Execution Vulnerability（CNVD-2022-01152）
32. threat[26697]:NetMizer log management system cmd.php remote command execution vulnerability
33. threat[27554]:D-Link NAS Device Command Injection Vulnerability (CVE-2024-3273/CVE-2024-3272)
34. threat[27231]:XWiki.org XWiki Solr Space Facet Code Injection Vulnerability(CVE-2024-31984)
35. threat[25575]:WordPress TI WooCommerce Wishlist Plugin SQL Injection Vulnerability (CVE-2022-0412)
36. threat[27209]:XWiki. org XWiki Database Search Code Injection Vulnerability(CVE-2024-31982)
37. threat[24601]:ThinkcmfX php Code Injection Vulnerability
38. threat[23774]:Microsoft Edge Remote Privilege Escalation Vulnerability(CVE-2016-0158)(MS16-038)
39. threat[26685]:Telesquare SDT-CW3B1 And TLR-2005KSH Command Execution Vulnerability (CVE-2021-46422/CVE-2024-29269)
40. threat[26455]:Fumeng Cloud CRM AjaxReadMail.ashx SQL Injection Vulnerability
41. threat[25516]:Spring Cloud Gateway Remote Code Execution Vulnerability(CVE-2022-22947)
42. threat[25463]:Hikvision Web Server Command Injection Vulnerability(CVE-2021-36260)
43. threat[26216]:Spring Boot Actuator H2 remote code execution vulnerability
44. threat[25236]:Seeyon OA thirdpartyController.do gets administrator Session
45. threat[25114]:Artica Proxy fw.login.php apikey SQL Injection Vulnerability(CVE-2020-17506)
46. threat[25313]:Microsoft Exchange Server Side Request Forgery(SSRF) Vulnerability(CVE-2021-26855/CVE-2021-26858)
47. threat[26070]:RConfig SQL Injection Vulnerability (CVE-2020-10547)
48. threat[27789]:Metinfo SQL Injection Vulnerability(CVE-2019-17418)
49. threat[27254]:Cacti api_automation.php SQL Injection Vulnerability(CVE-2024-31445)
50. threat[27261]:Cacti Command Injection Vulnerability (CVE-2024-29895)
51. threat[22052]: PHP-CGI Remote source leakage and Arbitrary Code Execution Vulnerability(CVE-2012-1823/CVE-2013-4878/CVE-2012-2336/CVE-2012-2311)_1
52. threat[23009]: PHP-CGI Remote source leakage and Arbitrary Code Execution Vulnerability(CVE-2012-1823/CVE-2013-4878/CVE-2012-2336/CVE-2012-2311)
53. threat[27814]:PHP/SANGFOR Desktop Cloud Report Center Remote Code Execution Vulnerability(CVE-2024-4577)
54. threat[22735]:PHP/SANGFOR Desktop Cloud Report Center Remote Code Execution Vulnerability(CVE-2024-4577)_1
55. threat[32456]:AgentScope Path Traversal Vulnerability(CVE-2024-8438)
56. threat[32559]:Apache Tomcat Path Traversal Vulnerability (CVE-2025-55752)
57. threat[23929]:Microsoft Edge Browser Chakra Engine Array.join Type Confusion(CVE-2016-7189)
58. threat[25553]:WordPress Photo Gallery Plugin bwg_tag_id_bwg_thumbnails_0 SQL Injection Vulnerability(CVE-2022-0169)
59. threat[25555]:F5 BIG-IP iControl REST Authentication Bypass Vulnerability(CVE-2022-1388)
60. threat[29793]:Ivanti Endpoint Manager Mobile MICSController Download Updates Command Injection Vulnerability(CVE-2025-10242)
61. threat[25437]:WordPress Automattic WooCommerce Blocks Plugin SQL Injection Vulnerability(CVE-2021-32789)




Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.44412. The new/improved rules of this upgrade package are:

new rules:

1. threat[29795]:Ivanti Endpoint Manager Remote Control logintype Authentication Bypass Vulnerability(CVE-2026-1603)
2. threat[42630]:Suspicious command execution in MSSQL databases
3. threat[29808]:CMS Made Simple moduleinterface Remote Code Execution Vulnerability(CVE-2018-1000094)
4. threat[29784]:MSSQL sp_OAMethod Execution
5. threat[29785]:MSSQL sp_OAGetProperty Execution
6. threat[42632]:SilverFox Spreads AtlasCross RAT
7. threat[26745]:D-Link DIR -645 A1 Remote Command Execution (CVE-2025-7192)
8. threat[42638]:MSSQL xp_fileexist Execution
9. threat[29796]:Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CVE-2025-20303)
10. threat[29797]:LibreNMS Alert Rule API Cross-Site Scripting Vulnerability (CVE-2025-68614)
11. threat[32831]:Squid Proxy Error Handling Information Disclosure Vulnerability (CVE-2025-62168)
12. threat[29807]:Msvod V10 lists SQL Injection Vulnerability(CVE-2018-14418)
13. threat[42639]:Suspicious privilege escalation activity in MSSQL databases
14. threat[42640]:Suspicious service control behavior in MSSQL databases (xp_servicecontrol: enabling and disabling services)

update rules:

1. threat[32810]:Delta Electronics DIAView WebHMI UploadProject Directory Traversal Vulnerability(CVE-2025-53417)
2. threat[29089]:Panabit libres_syn_delete Command Execution Vulnerability
3. threat[31643]:WordPress plugin Recall suffers from SQL injection vulnerability(CVE-2024-32709)
4. threat[42044]:Suspected PHP file inclusion using pseudo-protocols in request parameters
5. threat[32656]:IdeaCMS GetList.html SQL Vulnerability(CVE-2025-5569)
6. threat[28455]:TOTOLINK/Sapido Remote Code Execution Vulnerability(CVE-2024-51228/CVE-2021-4242)
7. threat[25938]:ESAFENET Electronic Document Security Management System dataimport Remote Command Execution Vulnerability(CNVD-2021-26058)
8. threat[29419]:XETUX Software dynamiccontent.properties.xhtml Remote Code Execution Vulnerability
9. threat[28181]:Maxview Storage Manager dynamiccontent.properties.xhtml Code Execution Vulnerability
10. threat[27506]:H3C User Self-service Platform dynamiccontent.properties.xhtml Remote Code Execution Vulnerability(CNVD-2021-39067)
11. threat[24444]:HPE Intelligent Management Center PrimeFaces Expression Language Injection Vulnerability(CVE-2017-1000486)
12. threat[63682]:HTTP SQL Injection Attempt(Error-Based Injection)
13. threat[42462]:Discover Server-Side Request ForgeryBypass Attack Behavior
14. threat[62105]:HTTP Directory Traversal Request Attempt
15. threat[60464]:HTTP Directory Traversal Vulnerability
16. threat[60245]:HTTP SQL Injection Attempt (Union Query Injection)
17. threat[24999]:Spring Boot Actuator Information Disclosure Vulnerability
18. threat[29487]:Cisco ASA/FTD VPN Unauthorized Access Vulnerability (CVE-2025-20362)
19. threat[26010]:Alibaba Nacos Authentication Bypass Vulnerability (CVE-2021-29441)
20. threat[27398]:West Digital NAS jqueryFileTree.php Command Execution Vulnerability
21. threat[23009]: PHP-CGI Remote source leakage and Arbitrary Code Execution Vulnerability(CVE-2012-1823/CVE-2024-4577)
22. threat[27117]:Progress Flowmon Command Injection vulnerability (CVE-2024-2389)
23. threat[27102]:WordPress WooCommerce Remote Code Execution Vulnerability(CVE-2022-1020)
24. threat[24941]:Nagios XI Chained Remote Code Execution Vulnerability(CVE-2018-8735)
25. threat[26505]:Sangfor NGFW Next-generation Firewall login.cgi Remote Command Execution Vulnerability
26. threat[26363]:Jeecg-boot JDBC testConnection arbitrary code execution vulnerability
27. threat[26723]:Liferay Portal Code Execution Vulnerability (CVE-2020-7961)
28. threat[26638]:Zhejiang Enter Customer Resource Management System CustomerAction.entphone Interface Arbitrary File Upload Vulnerability
29. threat[26637]:Zhejiang Enter Customer Resource Management System fileupload.jsp Arbitrary File Upload Vulnerability
30. threat[24649]:joomla 3.7 SQL Injection Vulnerability (CVE-2017-8917)
31. threat[25229]:FineReport V9 design_save_svg Arbitrary File Upload(CNVD-2021-34467)
32. threat[25471]:VMware vCenter Server Directory Traversal Vulnerability (CVE-2021-22013)
33. threat[24702]:LG SuperSign CMS 2.5 Remote Code Execution Vulnerability (CVE-2018-17173)
34. threat[26115]:Yongyou CHANJET T+ ajaxpro Frontend Remote Command Execution Vulnerability(CNVD-2023-48562)
35. threat[25697]:Microsoft Exchange Server Server-Side Request Forgery Vulnerability(CVE-2022-41040)
36. threat[25669]:Yonyou CHANJET T+ Upload.aspx Arbitrary File Upload Vulnerability(CNNVD-202209-001)(CNVD-2022-60632)
37. threat[25308]:H3C IMC Intelligent Management Center dynamiccontent.properties.xhtml expression Code Execution Vulnerability
38. threat[29591]:React Server Components Remote Code Execution Vulnerability (CVE-2025-55182/CVE-2025-66478)_2




Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.44344. The new/improved rules of this upgrade package are:

new rules:

1. threat[42616]:Litellm Supply Chain Poisoning Malicious External Connection Behavior
2. threat[32825]:Netgate pfSense Suricata suricata_ip_reputation.php iplist Directory Traversal(CVE-2025-34176)
3. threat[32826]:Yonyou Chanjet T+ FormReportOperateAction.aspx Arbitrary File Read Vulnerability
4. threat[29777]:Chanjet CRM newActivityedit.php SQL Injection Vulnerability(CVE-2025-5152)
5. threat[29778]:Chanjet CRM departmentsetting.php SQL Injection Vulnerability(CVE-2025-6132)
6. threat[42618]:Harbor Unauthorized Access Vulnerability (CVE-2022-46463)
7. threat[42617]:Suspicious configuration changes in the MSSQL database
8. threat[29780]:MSSQL xp_subdirs Execution
9. threat[29779]:Chanjet CRM upgradeattribute.php SQL Injection Vulnerability(CVE-2025-13788)
10. threat[32827]:Adobe ColdFusion _storeCFSettingFile Directory Traversal Vulnerability(CVE-2025-61812)
11. threat[42619]:Suspected Silver Fox Trojan Download Malicious Payload
12. threat[50677]:Suspicious Registry Operations on MSSQL Databases
13. threat[32828]:Zoho ManageEngine ADSelfService Plus Backup Code Usage Report SQL Injection Vulnerability(CVE-2026-1367)
14. threat[32824]:Yiyutong KingTrans Logistics Management System getAccountTypeByNumber SQL Injection Vulnerability
15. threat[42620]:Clash Tunnel Agent Communication Behavior _1
16. threat[42621]:Clash Tunnel Agent Communication Behavior _2
17. threat[29783]:BPM low-code development platform RichUploadFile Arbitrary File Upload Vulnerability
18. threat[42622]:BlackMoon Botnet Variant HTTPBot C2 Communication
19. threat[29786]:Progress LoadMaster OS Command Injection Remote Code Execution Vulnerability(CVE-2025-13444)
20. threat[42623]:Gomir Backdoor C2 Communication
21. threat[50676]:Operations on Sensitive Commands in PostgreSQL Databases
22. threat[42627]:Axios npm Repository Poisoning C2 Communication
23. threat[29787]:Sangfor Operations Security Management System upload_CN Remote Code Execution Vulnerability
24. threat[50678]:Suspicious command execution activity in the MSSQL database
25. threat[32829]:SKTMAX LEAN MES System TestManagePlatform.ashx SQL Injection Vulnerability
26. threat[42624]:BPFDoor Backdoor Controller C2 Communication
27. threat[42625]:Suspected VPN Tools Tunneling Behavior (Forging SNI Domain Names)
28. threat[29788]:Junos OS Evolved PTX Code Execution Vulnerability(CVE-2026-21902)
29. threat[29789]:Smart Campus (Anxiao Yi) Management System FileUpload.ashx Arbitrary File Upload Vulnerability
30. threat[32830]:LVS Lean Value Management System APPDownLoad.aspx Arbitrary File Read Vulnerability
31. threat[42626]:Suspected Malicious File Download_UDP
32. threat[29781]:WordPress Starter Templates Plugin real_mimes Arbitrary File Upload Vulnerability(CVE-2025-13065)
33. threat[29790]:Tenda FH1202 formWebTypeLibrary Buffer Overflow Vulnerability(CVE-2026-3808)
34. threat[29791]:Tenda FH1202 NatSaticSetting Buffer Overflow Vulnerability(CVE-2026-3809)
35. threat[29792]:Tenda FH1202 P2pListFilter Buffer Overflow Vulnerability(CVE-2026-3811)
36. threat[29793]:Ivanti Endpoint Manager Mobile MICSController Download Updates Command Injection Vulnerability(CVE-2025-10242)
37. threat[10633]:GNU Inetutils Telnetd Buffer Overflow Vulnerability (CVE-2026-32746)


update rules:

1. threat[32593]:Fortinet FortiWeb Path Traversal Vulnerability (CVE-2025-64446)
2. threat[29488]:Fortinet Fortiweb Command Injection Vulnerability (CVE-2025-58034)
3. threat[32438]:ZoneMinder SQL Injection Vulnerability (CVE-2024-43360)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.44268. The new/improved rules of this upgrade package are:

new rules:

1. threat[29770]:Microsoft Windows library-ms NTLM Relay Vulnerability(CVE-2025-59185)
2. threat[29772]:Microsoft Windows Notepad Markdown Link Handling Remote Code Execution Vulnerability(CVE-2026-20841)
3. threat[29773]:Langflow files Arbitrary File Write Vulnerability(CVE-2026-33309)
4. threat[42611]:Redis Suspicious Configuration File Modification Behavior
5. threat[42612]:Redis Suspicious Configuration File Modification Behavior (CONFIG REWRITE)
6. threat[29774]:Langflow build_public_tmp Remote Code Execution Vulnerability(CVE-2026-33017)
7. threat[42613]:Redis Suspicious Loading Dynamic Libraries Behavior
8. threat[42614]:Lua StealC v2 Send Stolen Infomation
9. threat[32821]:Centreon AWIE generateInstance SQL Injection Vulnerability(CVE-2025-15029)
10. threat[42615]:Redis Suspicious Slave Library Configuration Behavior
11. threat[32819]:Boshuo BGM Download.ashx Arbitrary File Read Vulnerability
12. threat[32820]:Sezhongda ERP NGInterface SQL Injection Vulnerability
13. threat[32823]:AnythingLLM move-files Directory Traversal Vulnerability(CVE-2024-8248)
14. threat[29775]:TOTOLINK X15 formMapDelDevice Command Injection Vulnerability(CVE-2025-8244)
15. threat[29776]:SKTMAX LEAN MES System UploadPortraits.ashx Arbitrary File Upload Vulnerability
16. threat[32822]:MetaCRM toviewspecial.jsp Arbitrary File Read Vulnerability
17. threat[29742]:DedeCMS select_images_post_wangEditor.php Arbitrary File Upload Vulnerability(CVE-2025-5137)
18. threat[29761]:Ivanti EPMM Operating System Command Injection Vulnerability (CVE-2025-10243)
19. threat[29762]:TOTOLINK X15 formMapReboot Command Injection Vulnerability(CVE-2025-5502)
20. threat[29763]:Arista NG Firewall runTroubleshooting Command Injection Vulnerability (CVE-2025-6978)
21. threat[29760]:Yonyou NC Cloud com.ufida.eip.adaptor.servlet.ServletForESBAdaptor Deserialization Vulnerability
22. threat[29766]:SolarWinds Web Help Desk Remote Code Execution Vulnerability (CVE-2025-26399)
23. threat[29765]:TOTOLINK X2000R formWsc command injection(CVE-2025-5504)
24. threat[29767]:GNU Inetutils Telnetd Environment Variable Injection Privilege Escalation Vulnerability (CVE-2026-28372)
25. threat[32814]:LibreNMS SQL Injection Vulnerability (CVE-2025-65093)
26. threat[29764]:Operations Involving Sensitive Commands in MySQL Databases
27. threat[29752]:Linksys RE6500 WPS Command Injection Vulnerability(CVE-2025-5438)
28. threat[32816]:Fortinet FortiSandbox Job Queue Priority Reflected Cross-Site Scripting Vulnerability(CVE-2025-52436)
29. threat[29768]:Sitecore PowerShell Extensions Arbitrary File Upload Vulnerability (CVE-2025-34511)
30. threat[32813]:WordPress The Events Calendar Plugin SQL Injection Vulnerability (CVE-2025-12197)
31. threat[32815]:Sanhui SMG Gateway Management Software 9-13pcap.php Arbitrary File Reading Vulnerability
32. threat[32817]:Netgate pfSense CE Directory Traversal Vulnerability (CVE-2025-34173)
33. threat[32818]:WordPress WP Statistics Plugin model Stored Cross-Site Scripting Vulnerability(CVE-2025-9816)
34. threat[29769]:TOTOLINK A3002RU formPortFw Cross-Site Scripting Vulnerability(CVE-2025-5505)
35. threat[29771]:emlog Arbitrary File Upload Vulnerability(CVE-2026-22799)


update rules:

1. threat[29488]:Fortinet Fortiweb Command Injection Vulnerability (CVE-2025-58034)
2. threat[32697]:ComfyUI-Manager CRLF Injection Vulnerability(CVE-2026-22777)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.44231. The new/improved rules of this upgrade package are:

new rules:

1. threat[29743]:SolarWinds Web Help Desk AjaxProxy Insecure Deserialization Vulnerability(CVE-2024-28988)
2. threat[29744]:Centreon Web Command Injection Vulnerability (CVE-2025-5965)
3. threat[10631]:Django html.py strip_tags Denial of Service Vulnerability(CVE-2025-32873)
4. threat[32809]:Weaver Cloud Bridge e-Bridge sendWxMsg SQL Injection Vulnerability
5. threat[29745]:Sibang Communication IP Network Intercom Broadcasting System addmediadatapath.php Arbitrary File Upload Vulnerability
6. threat[32810]:Delta Electronics DIAView WebHMI UploadProject Directory Traversal Vulnerability(CVE-2025-53417)
7. threat[29758]:Linksys RE6500 NTP Command Injection Vulnerability(CVE-2025-5440)
8. threat[29748]:Progress Multiple Products listapikeys Command Injection Vulnerability(CVE-2025-13447)
9. threat[29751]:Weaver E-cology 10 Remote Code Execution Vulnerability_2
10. threat[29749]:Weaver E-cology 10 Remote Code Execution Vulnerability_1
11. threat[29746]:Weaver E-cology 10 Remote Code Execution Vulnerability
12. threat[29750]:Zabbix Visible Name SQL Injection Vulnerability(CVE-2025-27240)
13. threat[29754]:Optilink Management System upgrade.php Arbitrary Command Execution Vulnerability
14. threat[29753]:Nagios XI Multiple Wizards Command Injection Vulnerability(CVE-2025-34227)
15. threat[32811]:Fortinet FortiSandbox hcproxy Reflected Cross-Site Scripting Vulnerability(CVE-2025-54353)
16. threat[29756]:Apache Kylin updateUserWithoutAuth Authentication Bypass Vulnerability(CVE-2025-61733)
17. threat[29755]:Qwik deserialization Remote Code Execution Vulnerability(CVE-2026-27971)
18. threat[32812]:Fortinet Forticlientems SQL Injection Vulnerability (CVE-2026-21643)
19. threat[29759]:LaRecipe server-side template injection vulnerability (CVE-2025-53833)
20. threat[10632]:D-Link formDdns Buffer Overflow Vulnerability(CVE-2025-13547)
21. threat[29757]:Linksys RE6500 verifyFacebookLike Command Injection Vulnerability(CVE-2025-5439)
22. threat[29733]:Visual Fusion Command and Dispatch Platform Arbitrary File Upload Vulnerability
23. threat[29734]:Jinhe OA OrderInfoView.aspx SQL Injection Vulnerability
24. threat[29735]:Jinhe OA LinkCharts.aspx SQL Injection Vulnerability
25. threat[29737]:WeKnora OS MCP stdio Transmission Channel Command Injection Vulnerability (CVE-2026-30861)
26. threat[42609]:MSSQL CLR Assembly Loading Suspected Malicious PE File Injection
27. threat[29738]:Sangfor Operations and Maintenance Security Management System CSSPOST Remote Command Execution Vulnerability
28. threat[29739]:Sangfor Operations and Maintenance Security Management System remote_get_clip_img Remote Command Execution Vulnerability
29. threat[29740]:WeGIA OS Command Injection Vulnerability (CVE-2026-28409)
30. threat[42610]:DuLang Spreading Malicious Programs C2 Communication
31. threat[29732]:Tenda HG10 checkUserFromLanOrWan Command Injection(CVE-2026-1689)
32. threat[32808]:Budibase Low-Code Platform Unauthorized Access Vulnerability (CVE-2026-31816)
33. threat[29736]:Dongsheng Logistics Software /SoftMng/FileInputHandler/Delete File Deletion Vulnerability
34. threat[50675]:Suspected OpenClaw Tool Communication
35. threat[29723]:Qinglong Panel dependencies Remote Code Execution Vulnerability


update rules:

1. threat[42179]:Suspected malicious file download
2. threat[42105]:Redis Suspicious File Write Behavior
3. threat[41660]:PostgreSQL COPY FROM PROGRAM Command Injection Vulnerability (CVE-2019-9193)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.44128. The new/improved rules of this upgrade package are:

new rules:

1. threat[32787]:Webkil QloApps SQL Injection Vulnerability (CVE-2023-36284)
2. threat[32788]:Zoho ManageEngine ADAudit Plus getIndividualReports SQL Injection Vulnerability(CVE-2025-3836)
3. threat[29705]:Sangfor Operations and Maintenance Security Management System get_clip_img Remote Command Execution Vulnerability(CVE-2026-1412)
4. threat[29706]:Sangfor Operations and Maintenance Security Management System port_validate Remote Command Execution Vulnerability(CVE-2026-1413)
5. threat[29707]:Sangfor Operations and Maintenance Security Management System get_Information Remote Command Execution Vulnerability(CVE-2026-1414)
6. threat[29708]:Sangfor Operations and Maintenance Security Management System change_net Remote Command Execution Vulnerability
7. threat[29709]:Sangfor Operations and Maintenance Security Management System del_route Remote Command Execution Vulnerability
8. threat[29710]:Sangfor Operations and Maintenance Security Management System del_net Remote Command Execution Vulnerability
9. threat[29711]:Netgate pfSense Suricata FlowStream policy_name Stored Cross-Site Scripting Vulnerability(CVE-2025-34177)
10. threat[29712]:WordPress LA-Studio Element Kit for Elementor Plugin Privilege Escalation Vulnerability(CVE-2026-0920)
11. threat[29713]:WordPress Custom Block Builder – Lazy Blocks Plugin Remote Code Execution Vulnerability(CVE-2026-1560)
12. threat[29715]:Sangfor Operations and Maintenance Security Management System add_DNS Remote Command Execution Vulnerability
13. threat[29714]:Apache OFBiz Scrum Plugin Argument Injection Vulnerability(CVE-2025-54466)
14. threat[32790]:Centreon Web SQL Injection Vulnerability (CVE-2026-2751)
15. threat[32791]:Allegra DatabaseBackupAction Directory Traversal Vulnerability
16. threat[32792]:Changjietong T+ Loadtreenode Directory Traversal Vulnerability
17. threat[29716]:Ivanti Endpoint Manager EFile CreateFile Arbitrary File Write Vulnerability(CVE-2025-9712)
18. threat[32793]:Reiming Technology Crocus System HardwareConfig.do SQL Injection Vulnerability
19. threat[32794]:Jinhui Integrated Management Information System UpdatePwd.aspx SQL Injection Vulnerability
20. threat[29717]:Langflow Remote Code Execution Vulnerability (CVE-2026-0770)
21. threat[29718]:Belkin F9K1122 Remote Command Injection Vulnerability(CVE-2025-11298)
22. threat[32795]:ZoneMinder SQL Injection Vulnerability (CVE-2026-27470)
23. threat[32789]:Samsung MagicINFO 9 Server parseXMLString XML External Entity Injection Vulnerability(CVE-2025-54445)
24. threat[32796]:JetBrains TeamCity uploadArchive Directory Traversal Vulnerability(CVE-2025-59456)
25. threat[29719]:Qinglong Panel Remote Code Execution Vulnerability
26. threat[29720]:Tenda AC1206 BehaviorManager Command Injection Vulnerability(CVE-2026-0581)
27. threat[32798]:NI FlexLogger usiReg URI File Parsing Directory Traversal Vulnerability(CVE-2025-2449)
28. threat[32797]:Cisco Catalyst SD-WAN Manager And Controller Information Leakage Vulnerability (CVE-2026-20127)
29. threat[29721]:Cisco Catalyst SD-WAN Manager And Controller File Upload Vulnerability (CVE-2026-20127)
30. threat[32799]:Code-Projects Content Management System SQL Injection Vulnerability(CVE-2026-0565)
31. threat[32801]:Quancheng Cloud OA QCHMS.asmx SQL Injection Vulnerability
32. threat[32807]:Nginx UI Unauthorized Backup Download And Encryption Key Leakage Vulnerability (CVE-2026-27944)
33. threat[32800]:Code-Projects Content Management System SQL Injection Vulnerability(CVE-2026-0564)
34. threat[29722]:Code-Projects Content Management System Arbitrary File Upload Vulnerability(CVE-2026-0566)
35. threat[32802]:Code-Projects Content Management System SQL Injection Vulnerability(CVE-2026-0567)
36. threat[32803]:JetBrains TeamCity checksTrigger DOM-based Cross-Site Scripting Vulnerability(CVE-2025-47851)
37. threat[29724]:TOTOLINK A7000R Command Injection Vulnerability (CVE-2026-1623)
38. threat[32804]:Youshuju CPAS Audit Management System V4 testOpenPDF Interface Arbitrary File Reading Vulnerability
39. threat[29726]:Ankerui Enterprise Microgrid Energy Efficiency Management System Default Password Login Vulnerability
40. threat[32805]:Yonyou KSOA save_folder SQL Injection Vulnerability
41. threat[32806]:Yonyou KSOA select SQL Injection Vulnerability
42. threat[29727]:Jinhe OA SubjectHandler.ashx SQL Injection Vulnerability
43. threat[29728]:Jinhe OA Budget_RegionType.aspx SQL Injection Vulnerability
44. threat[29729]:GNU Wget2 Path Traversal Arbitrary File Write Vulnerability (CVE-2025-69194)
45. threat[29731]:Jinhe OA OrderDelete.aspx SQL Injection Vulnerability
46. threat[29730]:Red Sea Cloud eHR StWasAssessDept SQL Injection Vulnerability
47. threat[29725]:Tenda HG10 Command Injection Vulnerability (CVE-2026-1687)


update rules:

1. threat[28306]:D-Link DI-8003 upgrade_filter.asp Stack-based Overflow Vulnerability(CVE-2024-11047)
2. threat[32453]:WordPress The Events Manager Plugin Temporal SQL Injection Vulnerability (CVE-2025-6970)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.44055. The new/improved rules of this upgrade package are:

new rules:

1. threat[29673]:Vmware Carbon Black App Control Authentication Bypass Vulnerability (CVE-2021-21998)
2. threat[32758]:WordPress Web Directory Free Plugin Local File Inclusion Vulnerability(CVE-2024-3673)
3. threat[29674]:Zimbra Collaboration Suite Server Request Forgery Vulnerability
4. threat[32762]:OpenClaw Control gatewayUrl Token Theft Vulnerability(CVE-2026-25253)
5. threat[32759]:SOPlanning Cross-Site Scripting Vulnerability(CVE-2024-33724)
6. threat[32760]:SOPlanning projets.php SQL Injection Vulnerability(CVE-2024-33722)
7. threat[32761]:CyberPower SQL Injection Vulnerability(CVE-2024-32736/CVE-2024-32737/CVE-2024-32738/CVE-2024-32739)
8. threat[29675]:Hangzhou Jiuqi Technology BigAnt Instant Messaging System loginByToken Unauthorized Access Vulnerability
9. threat[29677]:n8n Expression Bypass Leading to Remote Code Execution Vulnerability(CVE-2026-25049)
10. threat[29676]:XMLRPC Pingback Server-Side Request Forgery Vulnerability
11. threat[32763]:Spring Cloud Netflix Server Side Request Forgery Vulnerability (CVE-2020-5412)
12. threat[32764]:WebPageTest jpeginfo.php Server-Side Request Forgery Vulnerability
13. threat[29678]:Red Sea Cloud eHR BossIndex SQL Injection Vulnerability
14. threat[29680]:Jinhe OA GetSubjectTreeData.aspx SQL Injection Vulnerability
15. threat[29679]:AutoGPT Disabled Block Remote Code Execution Vulnerability(CVE-2026-24780)
16. threat[32765]:WordPress MasterStudy LMS Arbitary File Read Vulnerability(CVE-2024-3136)
17. threat[32766]:WordPress KiviCare Clinic & Patient Management System (EHR) SQL Injection Vulnerability(CVE-2024-11728)
18. threat[29681]:Samsung MagicINFO 9 Server getFontFileFromMagicInfoServer Unrestricted File Upload Vulnerability(CVE-2025-54441)
19. threat[29682]:Wordpress Plugin Domain Check Cross-Site Scripting Vulnerability (CVE-2021-24926)
20. threat[29683]:Langflow CSV Agent Remote Code Execution Vulnerability(CVE-2026-27966)
21. threat[29686]:WordPress Drag and Drop Multiple File Upload Plugin Path Traversal Leading to Arbitrary File Upload Vulnerability (CVE-2023-1112)
22. threat[29684]:JetBrains TeamCity agentpushPreset.html Reflected Cross-Site Scripting Vulnerability(CVE-2025-54534)
23. threat[29685]:Wordpress Plugin Newsletter Server-Side Request Forgery Vulnerability (CVE-2021-25033)
24. threat[32768]:Ignite Realtime Openfire Path Traversal Vulnerability (CVE-2019-18393)
25. threat[29687]:D-Link DIR850 Server-Sid Request Forgery Vulnerability (CVE-2021-46379)
26. threat[29688]:Nagios XI Redirection Vulnerability (CVE-2022-29272)
27. threat[32770]:LibreNMS Alert Template Stored Cross-Site Scripting Vulnerability(CVE-2025-55296)
28. threat[29689]:Jupyter Lab Unauthorized Access Vulnerability
29. threat[32767]:SPA-Cart eCommerce CMS Cross-Site Scripting Vulnerability(CVE-2023-4547)
30. threat[32769]:Mingsoft MCMS Cross-Site Scripting Vulnerability(CVE-2023-3990)
31. threat[32771]:rConfig Server-Side Request Forgery Vulnerability(CVE-2023-39108)
32. threat[29690]:Ollama Configuration Improper Unauthorized Access Vulnerability (CNVD-2025-04094)(CNNVD-202503-081)_2
33. threat[32774]:WordPress Onair2/KenthaRadio Plugin RFI/SSRF Vulnerability (CVE-2021-24472)
34. threat[32772]:NineJiaYi Management System picHY.aspx SQL Injection Vulnerability
35. threat[32773]:NineJiaYi Management System Ajax_XT.ashx SQL Injection Vulnerability
36. threat[32777]:dotCMS ContentType sites SQL Injection Vulnerability(CVE-2025-8311)
37. threat[29691]:MaxSite CMS Remote Code Execution Vulnerability (CVE-2026-3395)
38. threat[32775]:Hangzhou Jiuqi Technology BigAnt Instant Messaging System moveDept SQL Injection Vulnerability
39. threat[32776]:Hangzhou Jiuqi Technology BigAnt PublicController download Arbitrary File Read Vulnerability
40. threat[32778]:Hangzhou Jiuqi Technology BigAnt Instant Messaging System updateLoginName SQL Injection Vulnerability
41. threat[29692]:MajorDoMo Remote Code Execution Vulnerability (CVE-2026-27174)
42. threat[32780]:Advantech iView NetworkServlet processImportRequest Directory Traversal Vulnerability(CVE-2025-46704)
43. threat[32781]:MODx Revolution Path Traversal Vulnerability (CVE-2010-5278)
44. threat[32782]:mojoPortal Cross-Site Scripting Injection Vulnerability (CVE-2023-24322)
45. threat[29693]:Tenda F453 SafeMacFilter Buffer Overflow Vulnerability(CVE-2026-3376)
46. threat[29694]:Tenda F453 SafeUrlFilter Buffer Overflow Vulnerability(CVE-2026-3377)
47. threat[29695]:Tenda F453 qossetting Buffer Overflow Vulnerability(CVE-2026-3378)
48. threat[32779]:NineJiaYi Management System PrivilegedCodeDestroy.asmx SQL Injection Vulnerability
49. threat[29696]:Tenda F453 SetIpBind Buffer Overflow Vulnerability(CVE-2026-3379)
50. threat[29697]:Tenda F453 frmL7ImForm Buffer Overflow Vulnerability(CVE-2026-3380)
51. threat[29698]:Sangfor Operations and Maintenance Security Management System protocol/session Remote Command Execution Vulnerability(CVE-2026-1324)
52. threat[29701]:Centreon Arbitrary File Upload Leading to Command Execution Vulnerability (CVE-2026-2749)
53. threat[29700]:Sangfor Operations and Maintenance Security Management System protocol/session Remote Command Execution Vulnerability(CVE-2025-15502)
54. threat[29699]:WordPress Snow Monkey Forms Plugin Arbitrary File Deletion Vulnerability(CVE-2026-1056)
55. threat[29702]:Centreon Arbitrary Command Injection Vulnerability (CVE-2026-2750)
56. threat[32783]:Netgate pfSense Status_Traffic_Totals start-day Stored Cross-Site Scripting Vulnerability(CVE-2025-34174)
57. threat[32785]:ReQlogic Cross-Site Scripting Injection Vulnerability (CVE-2022-41441)
58. threat[32786]:SonicWall SMA100 radiusChallengeLogin Reflected Cross-Site Scripting Vulnerability(CVE-2025-40598)
59. threat[32784]:EyouCMS Path Traversal Vulnerability(CVE-2026-1107)
60. threat[29703]:Sangfor Operations and Maintenance Security Management System protocol/getHis Remote Command Execution Vulnerability(CVE-2025-15500)
61. threat[29704]:Sangfor Operations and Maintenance Security Management System protocol/getCmd Remote Command Execution Vulnerability(CVE-2025-15501)


update rules:

1. threat[24365]:ThinkPHP 5.x Remote Command Execution Vulnerability(CNVD-2018-24942/CVE-2018-20062)
2. threat[25564]:Vmware Workspace One Access Server Template Injection Vulnerability(CVE-2022-22954)
3. threat[28299]:AntSword Webshell Management Tool Connection and Control_3
4. threat[28360]:WordPress Query Console Plugin Unauthorized RCE Vulnerability(CVE-2024-50498)
5. threat[26164]:ZOHO ManageEngine ADManager Plus Command Injection Vulnerability (CVE-2023-29084)
6. threat[26840]:ZOHO ManageEngine Password Manager Pro Deserialization Vulnerability (CVE-2022-35405)
7. threat[27129]:Java Code Execution (URI)
8. threat[32086]:WordPress Paytm Payment Gateway Plugin Server-Side Request Forgery Vulnerability (CVE-2022-45362)
9. threat[31032]:Jellyfin Remote ImageController. cs SSRF Vulnerability(CVE-2021-29490)
10. threat[24961]:SQL Server Reporting Services RCE Vulnerability(CVE-2020-0618)
11. threat[26733]:Node.js ejs Template Prototype polluted Command Execution Vulnerability (CVE-2022-29078)
12. threat[25007]:Mida eFramework 2.9.0 - Remote Code Execution Vulnerability(CVE-2020-15920)
13. threat[24257]:Spring Framework isWritableProperty SpEL Injection Vulnerability(CVE-2018-1273)
14. threat[26952]:SpiderFlow Crawler Platform Remote Command Execution Vulnerability (CVE-2024-0195)
15. threat[25739]:Linux Shell Reverse Command Execution
16. threat[27150]:Java Code Execution (Request Body)
17. threat[31881]:WordPress Nirweb Support Plugin SQL Injection Vulnerability(CVE-2022-0781)
18. threat[42149]:SSRF Pseudo-Protocol Attacks Exist In Suspected Request Parameters
19. threat[42462]:Discover Server-Side Request ForgeryBypass Attack Behavior
20. threat[31764]:Razer Sila Gaming Router Arbitrary File Inclusion Vulnerability(CVE-2022-29014)
21. threat[26040]:post-exploitation command web execution
22. threat[42454]:Suspected HTTP Requests Exists XSS Injection Common Event Function
23. threat[42179]:Suspected malicious file download
24. threat[26037]:Permission maintenance command web execution
25. threat[25746]:Linux Information Collection Command Execution (Request Parameters)
26. threat[25747]:Windows Information Collection Command Execution
27. threat[41499]:HTTP Request Sensitive Path Access Attempt
28. threat[68655]:Suspicious Webshell Backdoor Access and Control
29. threat[28063]:Sangfor SSLVPN Frontend Arbitrary Password Reset Vulnerability
30. threat[29610]:SmarterMail file upload vulnerability(CVE-2025-52691)
31. threat[63249]:HTTP /etc/passwd Access Attempt



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.43906. The new/improved rules of this upgrade package are:

new rules:

1. threat[29671]:Yonyou BIP LoginWithV8 Login Bypass Vulnerability
2. threat[32756]:Advantech iView NetworkServlet getNextTrapPage SQL Injection Vulnerability(CVE-2025-53475)
3. threat[42608]:MYSQL Ransomware Text Insertion Behavior
4. threat[29672]:SEH utnserver Pro/ProMAX/INU-100 Cross-Site Scripting Vulnerability(CVE-2024-5420)
5. threat[32755]:CryWolf Path Traversal Vulnerability(CVE-2024-45241)
6. threat[32757]:WordPress Hostel Plugin Cross-Site Scripting Vulnerability(CVE-2024-3753)


update rules:

1. threat[26659]:Qizhi/H3C SecParh Bastion Host gui_detail_view.php Arbitrary User Login Vulnerability
2. threat[28165]:Seacms 6.4.5search.php Remote Command Execution Vulnerability
3. threat[31765]:Selea Targa IP OCR-ANPR Camera test_backup_server Server Request Forgery(SSRF) Vulnerability
4. threat[27499]:Showdoc Arbitrary File Upload Vulnerability (CNVD-2020-26585)
5. threat[41060]:Trojan/Backdoor General PHP trojan



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.43890. The new/improved rules of this upgrade package are:

new rules:

1. threat[32749]:Atlassian Jira Unauthorized Information Leak Vulnerability (CVE-2019-8446)
2. threat[29668]:Yeti Platform Server-Side Template Injection Vulnerability(CVE-2024-46507)
3. threat[32751]:Yonyou U8Cloud ce.paper.query SQL Injection Vulnerability
4. threat[32750]:Riello Netman 204 SQL Injection Vulnerability(CVE-2024-8877)
5. threat[32752]:WordPress Opti Marketing plugin SQL Injection Vulnerability(CVE-2024-6928)
6. threat[29669]:Wordpress Email Verification For Woocommerce Authentication Bypass Vulnerability
7. threat[32753]:WordPress Viral Signup Plugin SQL Injection Vulnerability(CVE-2024-6926)
8. threat[32754]:NetAlertX Arbitary File Read Vulnerability(CVE-2024-48766)
9. threat[29670]:Hasura Graphql Engine Server Sid Request Forgery Vulnerability


update rules:

1. threat[28543]:Cacti Insecure Deserialization Vulnerability (CVE-2023-30534)
2. threat[24726]:Cacti 1.2.8 Arbitrary OS Command Execution Vulnerability (CVE-2020-8813)
3. threat[25377]:Gitlab Server-Side Request Forgery(SSRF) Vulnerability(CVE-2021-22214)
4. threat[32638]:Apache Kylin downloadMetadataBackTmpFile Arbitrary File Read Vulnerability(CVE-2025-61734)
5. threat[31579]:F22 Clothing Management Software System Load.ashx Arbitrary File Reading Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.43867. The new/improved rules of this upgrade package are:

new rules:

1. threat[32742]:ChurchCRM Cross-Site Scripting Injection Vulnerability (CVE-2023-25346)
2. threat[29663]:Chaosblade Command Injection Vulnerability (CVE-2023-47105)
3. threat[32743]:ESAFENET CDG SQL Injection Vulnerability
4. threat[32744]:Zhiyue Human Resources Management System zyconfig.txt Sensitive Information Disclosure Vulnerability
5. threat[32745]:Zhiyue Human Resources Management System GenerateEntityFromTable.aspx SQL Injection Vulnerability
6. threat[32746]:WordPress Give WP Plugin Cross-Site Scripting Vulnerability(CVE-2024-11921)
7. threat[29665]:WordPress Everest Forms Plugin File Upload Vulnerability(CVE-2025-1128)
8. threat[29664]:Zoho ManageEngine ADAudit Plus SQL Injection Vulnerability(CVE-2025-36527)
9. threat[29666]:Weizhi Supply Chain Management System Unauthorized Command Execution Vulnerability
10. threat[32747]:WordPress ProfileGrid Plugin SQL Injection Vulnerability(CVE-2024-30490)
11. threat[29667]:Group Office Operating System Command Injection Vulnerability(CVE-2026-25512)
12. threat[32748]:Nagios Log Server API Key Disclosure Vulnerability(CVE-2025-44823)


update rules:

1. threat[42606]:Perlbot Botnet Script Transmission
2. threat[42224]:Sensitive Script File Upload _Suffix Newline Bypass
3. threat[24139]:Microsoft Edge Chakra arguments Off By One(CVE-2017-8671)
4. threat[23779]:Microsoft Edge Scripting Engine Remote Memory Corruption Vulnerability(CVE-2016-0193)(MS16-052)
5. threat[42225]:Sensitive Script File Upload _Filename Newline Bypass
6. threat[42209]:Sensitive Script File Uploaded _Double Suffix Bypass
7. threat[25121]:SaltStack Salt API SSH Client Command Injection Vunlerability (CVE-2020-16846)
8. threat[24355]:Oracle GoldenGate Manager Stack Buffer Overflow Vulnerability(CVE-2018-2913)
9. threat[42105]:Redis Suspicious File Write Behavior
10. threat[29383]:Sitecore Experience ViewState Inscure Deserialization Vulnerability (CVE-2025-53690)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.43834. The new/improved rules of this upgrade package are:

new rules:

1. threat[29650]:Ruijie M18000-WS-ED Wireless Controller CRL Command Injection Vulnerability
2. threat[32730]:WordPress Plugin Button Generator Cross-Site Request Forgery Vulnerability
3. threat[32731]:Tongda OA Upsharestatus SQL Injection Vulnerability
4. threat[32732]:Mingyuan Real Estate MyPub_XMLHTTP.aspx ParentCode SQL Injection Vulnerability
5. threat[29662]:BigAnt-Admin uploadMultipleFile.html Arbitrary File Upload Vulnerability
6. threat[32733]:WordPress Awin Data Feed Plugin Cross-Site Scripting Injection Vulnerability (CVE-2022-1937)
7. threat[42607]:Telesquare Tlr-2005Ksh Arbitrary File Deletion Vulnerability (CVE-2021-46424)
8. threat[29652]:WordPress wpDiscuz Plugin File Upload Vulnerability (CVE-2020-24186)
9. threat[29651]:n8n Edit FieldsNode Remote Code Execution Vulnerability (CVE-2026-1470)
10. threat[32734]:Jianwen Engineering Project Management Software DownLoad2.aspx Arbitrary File Read Vulnerability
11. threat[29653]:JinheOA Jhsoft.Web.dossier/XMLHttp.aspx XML External Entity Injection(XXE) Vulnerability
12. threat[29654]:Dokploy Command Injection Vulnerability(CVE-2026-24841)
13. threat[32735]:WSO2 Server Request Forgery Vulnerability
14. threat[29655]:D-Link Command Injection Vulnerability(CVE-2025-57105)
15. threat[32736]:Academy LMS 6.2 SQL Injection Vulnerability(CVE-2023-4974)
16. threat[32737]:Aptana Jaxer Path Traversal Vulnerability(CVE-2019-14312)
17. threat[32738]:FuMeng Cloud CRM lkpClientsCust.aspx SQL Injection Vulnerability
18. threat[32739]:Atlassian Jira Cross-Site Scripting Vulnerability(CVE-2019-3402)
19. threat[29656]:Netgate pfSense Dashboard Widgets widgetkey XML Injection Vulnerability(CVE-2024-54779)
20. threat[32740]:fnOS Directory Traversal Vulnerability
21. threat[32741]:Adiscon LogAnalyzer Cross-Site Scripting Vulnerability(CVE-2023-36306)
22. threat[29657]:Webmin CGI Request Handling CRLF Injection Vulnerability(CVE-2025-2774)
23. threat[29659]:D-Link NAS group Command Injection Vulnerability(CVE-2024-10915)
24. threat[29658]:Ivanti Endpoint Manager Mobile Code Injection Vulnerability (CVE-2026-1281/CVE-2026-1340)
25. threat[29660]:Faculty Evaluation System Remote Code Execution Vulnerability(CVE-2023-33440)
26. threat[29661]:BigAnt Instant Messaging System Arbitrary File Upload Vulnerability


update rules:

1. threat[29643]:Phpcms v9.6.3 Remote Command Execution Vulnerability
2. threat[42179]:Suspected malicious file download
3. threat[27102]:WordPress WooCommerce Remote Code Execution Vulnerability(CVE-2022-1020)
4. threat[27584]:Microchip Technology SyncServer S650 Command Injection Vulnerability (CVE-2022-40022)
5. threat[27818]:Unraid 6.8.0 Remote Code Execution Vulnerability (CVE-2020-5847)
6. threat[28667]:Vmware Aria Operations For Networks Remote Code Execution Vulnerability (CVE-2023-20888)
7. threat[26030]:WAVLINK WN535 K2-k3 Command Execution Vulnerability (CVE-2022-2487)
8. threat[26450]:Oracle WebLogic Server Deserialization Vulnerability (CVE-2019-2729)
9. threat[42454]:Suspected HTTP Requests Exists XSS Injection Common Event Function
10. threat[42484]:Suspected HTTP Requests Exists XSS Script Injection tag
11. threat[42605]:Suspected HTTP Requests Exists XSS Injection in AngularJS Framework
12. threat[29602]:Jinhe OA EatHandler.aspx SQL Injection Vulnerability
13. threat[25809]:Zyxel Firewall Remote Command Injection Vulnerability (CVE-2022-30525/CVE-2024-42057)
14. threat[42056]:Zyxel USG Series Default Password Vulnerability (CVE-2020-29583)
15. threat[25682]:Zoho ManageEngine ADAudit Plus External Entity Injection Vulnerability (CVE-2022-28219)
16. threat[25315]:F5 BIG-IP Authentication Bypass Vulnerabilities(CVE-2021-22986)
17. threat[26282]:Atlassian Jira Authentication Bypass Vulnerability(CVE-2022-0540)
18. threat[26514]:VMware Aria Operations for Logs Deserialization Vulnerability (CVE-2023-20864)
19. threat[42462]:Discover Server-Side Request ForgeryBypass Attack Behavior
20. threat[25388]:VMware vCenter Server Remote Code Execution Vulnerability(CVE-2021-21985)
21. threat[26090]:IBM Aspera Faspex Deserialization Vulnerability (CVE-2022-47986)
22. threat[29088]:VMware vRealize Network Insight Command Injection Vulnerability (CVE-2022-31702)
23. threat[25835]:PyLoad Remote Code Execution Vulnerability (CVE-2023-0297)
24. threat[27502]:ESAFENET DLP Multi-Interface Arbitrary Command Execution Vulnerability
25. threat[26620]:WordPress Plugin Code Snippets Cross-Site Scripting Vulnerability (CVE-2021-25008)
26. threat[30797]:TerraMaster TOS Sensitive Information Disclosure Vulnerability (CVE-2022-24990)
27. threat[42430]:Sensitive Script File Upload - Multi-Form Upload Bypass
28. threat[27104]:Jinhe OA C6 UploadFileEditorSave.aspx File Upload Vulnerability
29. threat[31400]:Bank Locker Management System Search-Locker Page Cross-Site Scripting Injection Vulnerability
30. threat[27002]:SRS Video Server Command Injection Vulnerability (CVE-2023-34105)
31. threat[25599]:Landray-OA Arbitrary File Read Vulnerability(CNVD-2021-28277)
32. threat[26088]:The Apache Airflow Command Injection Vulnerability (CVE-2022-24288)
33. threat[25797]:Webmin Command Execution Vulnerability (CVE-2022-36446)
34. threat[26657]:WordPress Plugin LearnPress Cross-Site Scripting Vulnerability (CVE-2022-0271)
35. threat[25759]:Yonyou nc bsh.servlet.BshServlet Command Execution Vulnerability(CNVD-2021-30167)
36. threat[29250]:CrushFTP Authentication Bypass Vulnerability(CVE-2025-54309)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.43743. The new/improved rules of this upgrade package are:

new rules:

1. threat[32711]:Ivanti Avalanche Directory Traversal Vulnerability(CVE-2021-30497)
2. threat[32712]:PrestaShop TshirteCommerce Path Traversal Vulnerability(CVE-2023-27639)
3. threat[32713]:OURPHP Cross-Site Scripting Vulnerability(CVE-2023-30210)
4. threat[32716]:Purchase Order Management Cross-Site Scripting Vulnerability(CVE-2023-29623)
5. threat[32714]:Advantech iView SQL injection vulnerability (CVE-2025-53515)
6. threat[10630]:SonicWall SMA100 Stack Buffer Overflow Vulnerability (CVE-2025-40596)
7. threat[32715]:OURPHP Cross-Site Scripting Vulnerability(CVE-2023-30212)
8. threat[42604]:Suspected HTTP Requests Exists XSS Injection in Vue Framework
9. threat[29638]:Ruijie EG Easy Gateway cli.php Remote Command Execution Vulnerability
10. threat[29639]:Ruijie EG Easy Gateway branch_passw Remote Command Execution Vulnerability
11. threat[29637]:GNU InetUtils Telnetd Remote Authentication Bypass Vulnerability(CVE-2026-24061)
12. threat[29640]:Ruijie RG-UAC Unified Internet Behavior Management Audit System user_commit.php Remote Command Execution Vulnerability
13. threat[29641]:Oracle Weblogic Server Proxy Plug-In Unauthorized Remote Command Execution Vulnerability (CVE-2026-21962)
14. threat[29642]:TOTOLink cstecgi.cgi Command Injection Vulnerability(CVE-2023-30013)
15. threat[32717]:Vanna V0.3.4 SQL Injection Vulnerability (CVE-2024-5827)
16. threat[32718]:Bluecms SQL Injection Vulnerability (CVE-2022-37113)
17. threat[32721]:Wordpress Rsvpmaker SQL Injection Vulnerability (CVE-2022-1768)
18. threat[42605]:Suspected HTTP Requests Exists XSS Injection in AngularJS Framework
19. threat[32719]:Youjiasoft Changjie Management System Service/ms_DBLis Unauthorized Access to Information Disclosure Vulnerability
20. threat[32720]:Youjiasoft Changjie Management System Sysconfig/GetZTList Unauthorized Access to Information Disclosure Vulnerability
21. threat[32722]:Youjiasoft Changjie Management System RepFile.ashx Arbitrary File Read Vulnerability
22. threat[29644]:Youjiasoft Changjie Management System DataHandler.ashx XML Entity Injection Vulnerability
23. threat[29645]:Dify v1.6.0 Server-Side Request Forgery Vulnerability(CVE-2025-56520)
24. threat[32723]:Atlassian Confluence Server Request Forgery Vulnerability
25. threat[32725]:WordPress Easy Social Feed Plugin Cross-Site Scripting Injection Vulnerability (CVE-2021-25120)
26. threat[32724]:WordPress 15Zine Plugin Cross-Site Scripting Injection Vulnerability (CVE-2020-36510)
27. threat[32726]:WordPress Perfect Survey Plugin SQL Injection Vulnerability (CVE-2021-24762)
28. threat[29646]:ThinkPHP SQL Injection Vulnerability (CVE-2021-44350)
29. threat[29647]:SmarterTools SmarterMail mail server administrator password reset vulnerability(CVE-2026-23760)
30. threat[32727]:Dahua ICC Intelligent IoT Integrated Management Platform env Sensitive Information Disclosure Vulnerability
31. threat[29648]:WordPress Contact Form 7 Arbitrary File Upload Vulnerability(CVE-2020-12800)
32. threat[32728]:Redis Server info information leakage
33. threat[32729]:WordPress oEmbed Proxy Server-Side Request Forgery Vulnerability
34. threat[29649]:SKTMAX LEAN MES MesATEApi.asmx Arbitrary File Upload Lead to RCE Vulnerability


update rules:

1. threat[41499]:HTTP Request Sensitive Path Access Attempt
2. threat[60245]:HTTP SQL Injection Attempt (Union Query Injection)
3. threat[27024]:WAGO Multiple Product Command Injection Vulnerability(CVE-2023-1698)
4. threat[28039]:PrestaShop Responsive Mega Menu Pro Remote Command Execution Vulnerability(CVE-2018-8823)
5. threat[31648]:JeecgBoot getTotalData SQL Injection Vulnerability(CVE-2024-48307)
6. threat[26357]:Jeecg-Boot Freemarker Template Injection Vulnerability(CVE-2023-4450)
7. threat[42602]:Suspected Malicious File Download _2
8. threat[32150]:HTTP SQL Injection Attempt (Sql Computation/Encoding)
9. threat[24676]:Satellian 1.1.2 remote code execution vulnerability(CVE-2020-7980)
10. threat[30867]:Tongda OA v11.6 insert SQL Injection Vulnerability
11. threat[31121]:HTTP SQL Injection Attempt (Database Fingerprinting Detection)
12. threat[32151]:HTTP SQL Injection Attempt (Database Change Operation)
13. threat[25216]:Tongda OA login_code.php session sensitive information leakage vulnerability
14. threat[29636]:Issabel Authenticated Remote Code Execution Vulnerability(CVE-2024-0986)
15. threat[42454]:Suspected HTTP Requests Exists XSS Injection Common Event Function
16. threat[62105]:HTTP Directory Traversal Request Attempt
17. threat[27449]:FUXA Command Injection Vulnerability (CVE-2023-33831)
18. threat[31908]:Prestashop Advancedpopupcreator SQL Injection Vulnerability (CVE-2023-27032)
19. threat[31302]:Netgear-WN604 downloadFile.chp information Leak Vulnerability(CVE-2024-6646)
20. threat[25253]:Ruijie NBR Routers EWEB guestIsUp.php Remote Command Execution Vulnerability(CNVD-2021-09650)
21. threat[29402]:Ruijie EWEB Router control.php Remote Command Execution Vulnerability
22. threat[25752]:Linux Information Collection Command Execution Success
23. threat[29241]:Ruijie Networks RG-UAC Command Injection Vulnerability (CVE-2024-6187)
24. threat[26948]:PlaySMS Input Validation Error Vulnerability (CVE-2020-8644)
25. threat[62201]:HTTP SQL Injection Attempt (Boolean blind injection)
26. threat[25707]:Sangfor EDR c.php Remote Code Execution Vulnerability(CNVD-2020-46552)
27. threat[31886]:Rudder Server SQL Injection Vulnerability (CVE-2023-30625)
28. threat[26945]:Apache Kafka Remote Code Execution Vulnerability(CVE-2023-25194)_2
29. threat[31188]:WordPress Plugin Pricing Table Builder SQL Injection Vulnerability (CVE-2023-0900)
30. threat[31181]:WordPress plugin Steveas WP Live Chat Shoutbox SQL Injection Vulnerability (CVE-2023-1020)
31. threat[27999]:WordPress Plugin Gift Cards SQL Injection Vulnerability (CVE-2023-28662)
32. threat[27095]:Slimstat Analytics SQL Injection Vulnerability(CVE-2023-0630)
33. threat[31638]:WordPress-Dropdown-CF7 plugin suffers from sql injection vulnerability(CVE-2024-3495)
34. threat[31640]:WordPress-WebDirectory plugin sql injection vulnerability(CVE-2024-3552)
35. threat[26910]:Jinhe OA jc6 SQL Injection Vulnerability
36. threat[28881]:JizhiCMS website builder system backend SQL injection vulnerability(CVE-2022-36578)
37. threat[30812]:E-cology browser.jsp SQL Injection Vulnerability(CNVD-2023-12632)
38. threat[24961]:SQL Server Reporting Services RCE Vulnerability(CVE-2020-0618)
39. threat[28957]:MinIO Unauthorized SSRF Vulnerability (CVE-2021-21287)
40. threat[25784]:Atlassian Bitbucket Command Injection Vulnerability (CVE-2022-36804)
41. threat[25577]:Oracle Access Manager OpenSSO Agent Insecure Deserialization(CVE-2021-35587)
42. threat[28389]:Belkin Linksys RE6500 Arbitrary Command Execution Vulnerability(CVE-2020-35713)
43. threat[25724]:TrendNET/D-Link Router Authorization Bypass Vulnerability(CVE-2018-7034/CVE-2020-9376/CVE-2020-15894/CVE-2024-33113/CVE-2025-14528)
44. threat[25555]:F5 BIG-IP iControl REST Authentication Bypass Vulnerability(CVE-2022-1388)
45. threat[25863]:SolarView Compact Command Injection Vulnerability (CVE-2022-29303)
46. threat[27960]:H3C Magicr300 Remote Code Execution Vulnerability (CVE-2023-33629)
47. threat[27020]:Ivanti Connect Secure XXE Vulnerability (CVE-2024-22024)
48. threat[24207]:Oracle WebLogic Server Remote Code Execution Vulnerability（CVE-2017-10271/CVE-2017-3506）
49. threat[25804]:Spring Data MongoDB SpEL Expression Injection Code Execution Vulnerability (CVE-2022-22980)
50. threat[26616]:Viessmann Vitogate Remote Code Execution Vulnerability(CVE-2023-45852)
51. threat[26788]:Wavlink WL-WN535K2_K3 command injection vulnerability (CVE-2022-2486)
52. threat[26776]:Wavlink device command injection vulnerability(CVE-2020-13117/CVE-2022-35526)
53. threat[25145]:Weblogic Server Remote Code Execution Vulnerability(CVE-2021-2109)
54. threat[24550]:Webmin Remote Code Execution Vulnerability(CVE-2019-15107)
55. threat[24530]:Jira Unauthorized Server Template Injection Remote Code Execution Vulnerability (CVE-2019-11581)
56. threat[25339]:Websvn 2.6.0 - Remote Code Execution Vulnerability(CVE-2021-32305)
57. threat[31965]:WordPress plugin WP-Guru arbitrary file read vulnerability(CVE-2024-12849)
58. threat[42484]:Suspected HTTP Requests Exists XSS Script Injection tag
59. threat[25093]:WordPress File Manager connector.minimal.php Improper Access Control Vulnerability (CVE-2020-25213)
60. threat[31404]:WordPress Plugin CMP-Coming Soon&Maintenance Information Disclosure Vulnerability(CVE-2023-1263)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.43614. The new/improved rules of this upgrade package are:

new rules:

1. threat[29628]:Wifisoft UniBox Controller File Upload Leading to Command Execution Vulnerability(CVE-2025-6103)
2. threat[29630]:Wifisoft UniBox Controller File Upload Leading to Command Execution Vulnerability(CVE-2025-6102)
3. threat[32705]:LiveGBS user/save Information Disclosure Vulnerability(CNVD-2023-81130)
4. threat[32706]:Wifi Soft Unibox Administration SQL Injection Vulnerability(CVE-2023-34635)
5. threat[29629]:Nagios XI Remote Code Execution Vulnerability(CVE-2019-20197)
6. threat[29631]:Sonatype Nexus Repository Remote Code Execution Vulnerability(CVE-2024-5082)
7. threat[29632]:n8n Python Sandbox Escape Code Execution Vulnerability (CVE-2026-0863)
8. threat[29633]:Gridx Remote Command Execution Vulnerability (CVE-2020-19625)
9. threat[32707]:Landray EIS Work.aspx SQL Injection Vulnerability
10. threat[29634]:H3C SecCenter SMP Security Management Platform File Upload Vulnerability
11. threat[32709]:PrestaShop leocustomajax SQL Injection Vulnerability(CVE-2023-30150)
12. threat[32708]:OpenBMCS Server-Side Request Forgery Vulnerability
13. threat[29635]:Livewire Code Injection Vulnerability(CVE-2025-54068)
14. threat[32710]:OpenCMS XML External Entity Injection Vulnerability(CVE-2023-42344)


update rules:

1. threat[31121]:HTTP SQL Injection Attempt (Database Fingerprinting Detection)
2. threat[25203]:D-Link DAP-2020 Operating System Command Injection Vulnerability (CVE-2021-27249/CVE-2021-27250)
3. threat[25063]:Artica Proxy cyrus.php Command Injection(CVE-2020-17505)
4. threat[24670]:PandoraFMS v7.0NG Remote Code Execution Vulnerability (CVE-2019-20224)
5. threat[42462]:Discover Server-Side Request ForgeryBypass Attack Behavior
6. threat[42149]:SSRF Pseudo-Protocol Attacks Exist In Suspected Request Parameters
7. threat[24856]:Sonatype Nexus Repository Manager EL Expression Injection Vulnerability (CVE-2020-10199)
8. threat[25839]:Node.js Command Injection Vulnerability(CVE-2021-21315)
9. threat[29626]:MAGMI Cross-site Request Forgery Vulnerability
10. threat[28557]:WordPress Ultimate Member Plugin Privilege Escalation Vulnerability (CVE-2023-3460)
11. threat[24941]:Nagios XI Chained Remote Code Execution Vulnerability(CVE-2018-8735)
12. threat[27467]:Netsweeper Command Injection Vulnerability (CVE-2020-13167)
13. threat[32151]:HTTP SQL Injection Attempt (Database Change Operation)
14. threat[62178]:HTTP SQL Injection Attempt(System Command Execution)
15. threat[28668]:XWiki Platform Remote Code Execution Vulnerability(CVE-2025-24893)
16. threat[42454]:Suspected HTTP Requests Exists XSS Injection Common Event Function
17. threat[42179]:Suspected malicious file download



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.43563. The new/improved rules of this upgrade package are:

new rules:

1. threat[29622]:Fortinet FortiSIEM Command Injection Vulnerability (CVE-2025-64155)
2. threat[29623]:OpenCode Unauthorised HTTP Service Arbitrary Command Execution Vulnerability(CVE-2026-22812)
3. threat[32696]:Craft CMS API SQL Injection Vulnerability(CVE-2024-37843)
4. threat[32697]:ComfyUI-Manager CRLF Injection Vulnerability(CVE-2026-22777)
5. threat[32698]:Linkerd Server-Side Request Forgery Vulnerability
6. threat[32699]:DevDojo Voyager Compass Arbitrary File Reading Vulnerability(CVE-2024-55415)
7. threat[29626]:MAGMI Cross-site Request Forgery Vulnerability
8. threat[29625]:Default Password for Xinhu Collaborative Office System
9. threat[32702]:MicroStrategy TinyURL Server-Side Request Forgery Vulnerability
10. threat[32703]:DevDojo Voyager Cross-Site Scripting Vulnerability(CVE-2024-55416)
11. threat[32700]:Dibo Data Decision Making System downloadImpTemplet Path Traversal Vulnerability(CVE-2025-11034）
12. threat[32701]:Unibox router PostProsa SQL Injection Vulnerability
13. threat[32704]:NagiosXI SQL Injection Vulnerability(CVE-2018-8734)


update rules:

1. threat[32687]:n8n webhook Sensitive Information Leakage Vulnerability(CVE-2026-21858)
2. threat[29618]:Tencent Weknora Command Injection Vulnerability (CVE-2026-22688)
3. threat[26826]:Seeyon M3 Remote Code Execution Vulnerability
4. threat[26033]:Yonyou-NC-Cloud jsinvoke Arbitrary File Upload Vulnerability
5. threat[60245]:HTTP SQL Injection Attempt (Union Query Injection)
6. threat[31510]:HTTP SQL Injection Attempt(Other)
7. threat[62178]:HTTP SQL Injection Attempt(System Command Execution)
8. threat[32151]:HTTP SQL Injection Attempt (Database Change Operation)
9. threat[31757]:Like Button Rating Server-Side Request Forgery (SSRF) Vulnerability(CVE-2021-24150)
10. threat[24141]:Apache CouchDB Privilege Escalation Vulnerability(CVE-2017-12635)
11. threat[25335]:Apache Airflow 1.10.10 Remote Code Execution Vulnerability(CVE-2020-11978)
12. threat[25006]:Apache Shiro Authentication Bypass Vulnerability (CVE-2020-1957)
13. threat[42454]:Suspected HTTP Requests Exists XSS Injection Common Event Function
14. threat[27188]:LiveGBS user/save Logic Flaw Vulnerability(CNVD-2023-72138)
15. threat[29453]:Open Webui Arbitrary Code Execution Vulnerability (CVE-2025-64495)
16. threat[25129]:Apache Unomi Remote Code Execution Vulnerability(CVE-2020-13942)
17. threat[32150]:HTTP SQL Injection Attempt (Sql Computation/Encoding)
18. threat[42462]:Discover Server-Side Request ForgeryBypass Attack Behavior
19. threat[31437]:DLINK DAP-1620 Directory Traversal Vulnerability(CVE-2021-46381)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.43524. The new/improved rules of this upgrade package are:

new rules:

1. threat[29611]:SmarterMail file upload vulnerability_1(CVE-2025-52691)
2. threat[32683]:Rocket TRUfusion Enterprise Directory Traversal Vulnerability (CVE-2025-27222)
3. threat[32684]:Ankerui Intelligent Environmental Protection Cloud Platform GetDates Interface SQL Injection Vulnerability
4. threat[42603]:RomCom APT Deliver Mythic Agent
5. threat[29612]:Netgate pfSense suricata_filecheck.php Reflected Cross-Site Scripting Vulnerability(CVE-2025-34175)
6. threat[29613]:D-Link DIR-841 Command Injection Vulnerability(CVE-2021-28143)
7. threat[29614]:D-Link DIR-846 Command Injection Vulnerability(CVE-2020-27600)
8. threat[32685]:Mongodb Zlib Compression Protocol Sensitive Information Leakage Vulnerability(CVE-2025-14847)
9. threat[32686]:Weaver E-message Authentication Bypass Vulnerability
10. threat[32687]:n8n webhook Sensitive Information Leakage Vulnerability(CVE-2026-21858)
11. threat[32688]:D-Link DIR-859 hedwig.cgi Path Traversal Vulnerability(CVE-2024-0769)
12. threat[29615]:Mitel MiVoice Connect Code Execution Vulnerability(CVE-2022-29499)
13. threat[32690]:MSService Service init.do SQL Injection Vulnerability
14. threat[29616]:Mongo-Express Remote Code Execution Vulnerability(CVE-2020-24391)
15. threat[32689]:D-Link DVG-N5402SP Path Traversal Vulnerability(CVE-2015-7245)
16. threat[29617]:D-Link nas_sharing Command Injection Vulnerability(CVE-2024-45698)
17. threat[32692]:Ncast High-Definition Intelligent Recording And Broadcasting System downloadLog.php Arbitrary File Read Vulnerability
18. threat[29618]:Tencent Weknora Command Injection Vulnerability (CVE-2026-22688)
19. threat[32694]:rustfs Path Traversal Vulnerability (CVE-2025-68705)
20. threat[32693]:Struts2 XML External Entity Injection Vulnerability (CVE-2025-68493) (S2-069)
21. threat[29619]:FasterXML Jackson-databind JdbcRowSetImpl Remote Code Execution Vulnerability
22. threat[29620]:D-Link chkisg.htm Command Injection Vulnerability(CVE-2018-10823)
23. threat[32695]:MindsDB Unauthorized Path Traversal Vulnerability(CVE-2025-68472)
24. threat[29621]:MagnusBilling Remote Code Execution Vulnerability(CVE-2023-30258)
25. threat[29597]:Microsoft SharePoint Server Deserialization Leading to Command Execution Vulnerability (CVE-2025-47163)
26. threat[42598]:Dark Crystal RAT Online


update rules:

1. threat[25717]:Laravel _ignition Remote Code Execution Vulnerability(CVE-2021-3129)
2. threat[32150]:HTTP SQL Injection Attempt (Sql Computation/Encoding)
3. threat[31239]:XML XSS Cross-Site Script File Upload
4. threat[31121]:HTTP SQL Injection Attempt (Database Fingerprinting Detection)
5. threat[26880]:Wanhu OA showResult.action Background SQL Injection Vulnerability
6. threat[27626]:Wanhu OA ezOffice RhinoScriptEngineService Command Execution Vulnerability
7. threat[62201]:HTTP SQL Injection Attempt (Boolean blind injection)
8. threat[50652]:XML External Entity Injection (XXE)-(HTML Entity Encoding/UTF-16/UTF-7)
9. threat[26010]:Alibaba Nacos Authentication Bypass Vulnerability (CVE-2021-29441)
10. threat[26322]:Seeyon OA A8+ front getAjaxDataServlet XXE vulnerability
11. threat[26957]:Gopher Protocol - Server Side Request Forgery(SSRF)
12. threat[42149]:SSRF Pseudo-Protocol Attacks Exist In Suspected Request Parameters
13. threat[42462]:Discover Server-Side Request ForgeryBypass Attack Behavior
14. threat[26756]:Wanhu OA TeleConferenceService/freemarkeService XXE Injection Vulnerability
15. threat[31510]:HTTP SQL Injection Attempt(Other)
16. threat[42454]:Suspected HTTP Requests Exists XSS Injection Common Event Function
17. threat[10604]:XML Parameter Entity Bloat Leads to Dos
18. threat[25062]:Apache OFBiz XMLRPC Insecure Deserialization(CVE-2020-9496)
19. threat[26734]:Apache OFBiz XML-RPC Deserialization Vulnerability (CVE-2023-49070)
20. threat[27413]:MLflow Arbitrary File Read Vulnerability(CVE-2023-1177/CVE-2023-6977)
21. threat[25498]:D-Link DNS-320 Command Injection Vulnerability (CVE-2020-25506)
22. threat[42484]:Suspected HTTP Requests Exists XSS Script Injection tag
23. threat[29600]:n8n Command Execution Vulnerability(CVE-2025-68668)
24. threat[26849]:Apache OFBiz groovy Remote Code Execution Vulnerability(CVE-2023-51467)
25. threat[25236]:Seeyon OA thirdpartyController.do gets administrator Session
26. threat[24098]:Apache Struts2 REST Plugin Remote Code Execution Vulnerability(CVE-2017-9805)(S2-052)
27. threat[24302]:Suspicious XML External Entity(XXE) Injection Attempt
28. threat[42327]:Hancitor Malware C2 Communication
29. threat[63682]:HTTP SQL Injection Attempt(Error-Based Injection)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.43424. The new/improved rules of this upgrade package are:

new rules:

1. threat[29593]:Allsky Camera Command Execution Vulnerability(CVE-2025-63414)
2. threat[32668]:Saipu EAP Enterprise Adaptation Management Platform AppData SQL Injection Vulnerability
3. threat[42596]:ModiLoader C2 Communication
4. threat[42597]:Sipvicious Scanning Tool Detects Voip Service Behavior
5. threat[29594]:Western Digital NAS addons/upload.php Arbitrary File Upload Vulnerability
6. threat[42599]:Dark Crystal RAT C2 Communication
7. threat[32669]:Zimbra Collaboration File Contains Vulnerability(CVE-2025-68645)
8. threat[32670]:AnythingLLM Unauthorised Access Vulnerability(CVE-2024-3033)
9. threat[32672]:LocalAI Cross-Site Scripting(XSS) Vulnerability(CVE-2024-48057)
10. threat[32671]:Label Studio Information Leak Vulnerability(CVE-2023-47117)
11. threat[32673]:Adminer Remote File Reading Vulnerability(CVE-2021-43008)
12. threat[32674]:Grafana OSS Cross-Site Scripting Injection Vulnerability (CVE-2025-6023)
13. threat[32675]:SAMSUNG MagicINFO 9 Server Directory Traversal Vulnerability (CVE-2025-54453)
14. threat[32676]:Open WebUI ollama/verify SSRF Vulnerability(CVE-2025-29446)
15. threat[29595]:Dongsheng Logistics /MvcShipping/MsCodeAll/GetLanesList SQL Injection Vulnerability
16. threat[29596]:Flowise reset-password arbitrary user password reset vulnerability(CVE-2025-58434)
17. threat[29598]:Jinhe OA QuickMatch.aspx XXE Vulnerability
18. threat[32677]:Youjia Changjie Management System downloadfile.ashx Arbitrary File Read Vulnerability
19. threat[29599]:Belkin F9K1122 Remote Command Injection Vulnerability (CVE-2025-7082)
20. threat[29600]:n8n Command Execution Vulnerability(CVE-2025-68668)
21. threat[29602]:Jinhe OA ProjectInfos.aspx SQL Injection Vulnerability
22. threat[42600]:XWorm RAT C2 Communication
23. threat[42601]:Bitter Loads Malicious Documents
24. threat[29601]:Wordpress Wp-Registration Plugin Privilege Escalation Vulnerability (CVE-2025-4334)
25. threat[32678]:Langflow Authentication Bypass Vulnerability(CVE-2026-21445)
26. threat[29605]:browser-use WebUI pickle Deserialization Vulnerability
27. threat[29603]:TOTOLINK X18 Command Injection Vulnerability(CVE-2025-1339)
28. threat[42602]:Suspected Malicious File Download _2
29. threat[32679]:Apache Tika XML External Entity Injection Vulnerability (CVE-2025-66516)
30. threat[32680]:Dahua ICC Intelligent IoT Management Platform list Interface SQL Injection Vulnerability
31. threat[32681]:Kuaiyun Server Assistant GetDetail Arbitrary File Read Vulnerability
32. threat[29606]:Fujian Kelixun Communication Command and Dispatch Management Platform custom/zx/upload.php Arbitrary File Upload Vulnerability
33. threat[29607]:Weave E-Cology E-office /iWebOffice/OfficeServer2.php Arbitrary File Upload Vulnerability
34. threat[29608]:Dataease Arbitrary Interface Access Vulnerability(CVE-2024-47073)
35. threat[29604]:Dongsheng Logistics Software FeeModifySource.aspx SQL Injection Vulnerability
36. threat[29610]:SmarterMail file upload vulnerability(CVE-2025-52691)
37. threat[42590]:MacSync Stealer C2 Connection
38. threat[42591]:MacSync Stealer Steals Information


update rules:

1. threat[25470]:Malware Mining ETHMiner Obtains Mining Tasks
2. threat[42147]:HTTP Sensitive Parameters Execute Arbitrary Command Attempt
3. threat[26041]:Post-exploitation Stealth Command Execution
4. threat[25516]:Spring Cloud Gateway Remote Code Execution Vulnerability(CVE-2022-22947)
5. threat[32041]:Zhiyuan Internet FE Collaborative Office Platform addUser.jsp SQL Injection Vulnerability(CVE-2025-2030)
6. threat[28902]:Jumpserver Arbitrary Password Reset Vulnerability (CVE-2023-42820)
7. threat[28995]:DataEase JWT Arbitrary Forgery Vulnerability (CVE-2025-49001)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.43353. The new/improved rules of this upgrade package are:

new rules:

1. threat[32667]:Jinhe OA BudgetDecomposeEdit.aspx SQL Injection Vulnerability
2. threat[29578]:H3C iMC Default Password Login Vulnerability
3. threat[32659]:DPTech VPN Arbitrary File Reading Vulnerability(CNVD-2023-69478)


update rules:

1. threat[27050]:Apache OFBiz Path Traversal Vulnerability (CVE-2024-25065)
2. threat[27376]:Apache OFBiz Path Traversal Leads to RCE Vulnerability (CVE-2024-36104/CVE-2024-32113)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.43346. The new/improved rules of this upgrade package are:

new rules:

1. threat[29585]:Sitecore Multiple Products uiUpload Pipeline ZIP File Writing Vulnerability (CVE-2025-34510)
2. threat[29580]:n8n Remote Code Execution Vulnerability (CVE-2025-68613)
3. threat[29582]:Splunk Enterprise pdfgen Reflected Cross-Site Scripting Vulnerability (CVE-2025-20297)
4. threat[29587]:Tianrui Green Shield Approval System updateFilePrintParamsD.do Deserialization Vulnerability
5. threat[29588]:Tianrui Green Shield Approval System updateFileOutSendParameter.do Deserialization Vulnerability
6. threat[29589]:Tianrui Green Shield Approval System updateScreenshotParameter.do Deserialization Vulnerability
7. threat[29590]:Tianrui Green Shield Approval System updateBehaviorCtrlParams.do Deserialization Vulnerability
8. threat[29591]:React Server Components Remote Code Execution Vulnerability (CVE-2025-55182/CVE-2025-66478)_2
9. threat[29592]:VIVOTEK FD8177 Command Injection Vulnerability(CVE-2018-14771)
10. threat[42593]:DarkRAT C2 Communication
11. threat[42594]:DarkRAT Executes The Task
12. threat[42595]:DarkRAT v2 C2 Communication
13. threat[29561]:Jinhe OA CostApplyHandler.ashx SQL Injection Vulnerability
14. threat[32652]:Yonyou NC6.5 rmwebImage/download SQL injection vulnerability
15. threat[29562]:Jinhe OA AjaxForGetBudgetTime.ashx SQL Injection Vulnerability
16. threat[29563]:Cisco ISE disableStrongSwanTunnel Insecure Deserialization Vulnerability(CVE-2025-20283)
17. threat[29564]:Cisco ISE handleStrongSwanTunnelStatus Insecure Deserialization Vulnerability(CVE-2025-20284)
18. threat[29565]:Cisco ISE enableStrongSwanTunnel Insecure Deserialization Vulnerability(CVE-2025-20337)
19. threat[32653]:Hanwang eFace Integrated Management Platform exportFilePath.do Arbitrary File Read Vulnerability
20. threat[32654]:ChuanhuChatGPT Unauthorised Access Vulnerability (CVE-2024-2217)
21. threat[32656]:IdeaCMS GetList.html SQL Vulnerability(CVE-2025-5569)
22. threat[29566]:Jinhe OA ProjectInfos.aspx SQL Injection Vulnerability
23. threat[32657]:SKTMAX LEAN MES EquipmentTree.ashx SQL Vulnerability
24. threat[32655]:Jinhe OA AjaxForDepartmentCollect.ashx SQL Injection Vulnerability
25. threat[29569]:WatchGuard Fireware OS Stack Buffer Overflow Vulnerability(CVE-2025-9242)
26. threat[32658]:WSO2 CarbonAppUploader Directory Traversal Vulnerability(CVE-2025-3125)
27. threat[42587]:Malicious Mining Program Ethminer Submits Information About Mining Machines
28. threat[29570]:LangBot documents arbitrary file upload vulnerability(CVE-2025-59835)
29. threat[29571]:Netgate pfSense suricata_sid_mgmt.php Remote Code Execution Vulnerability(CVE-2025-12490)
30. threat[29567]:Ivanti Endpoint Manager Mobile Remote Command Injection Vulnerability (CVE-2025-6770)
31. threat[10627]:Linux Kernel Ksmbd Module NULL Pointer Dereference Vulnerability (CVE-2025-38191)
32. threat[29572]:Chengdu Langsu ERP System WebDwgDefault.aspx Arbitrary File Upload Vulnerability
33. threat[32662]:ZendTo Directory Traversal Vulnerability (CVE-2025-34508)
34. threat[32660]:Label Studio Cross-Site Scripting (XSS) Vulnerability(CVE-2025-47783/CVE-2025-25296)
35. threat[29573]:Siemens SINEC NMS SQL Injection Vulnerability(CVE-2025-40755)
36. threat[29574]:Veeam Backup and Replication CProxyBinaryFormatter .NET Deserialization Vulnerability (CVE-2025-23121)
37. threat[29576]:Veeam Backup and Replication Remote Code Execution Vulnerability(CVE-2025-24286)
38. threat[29577]:Jinhe OA CostReimbursementHandler.ashx SQL Injection Vulnerability
39. threat[29575]:Tenda O3V2 Injection Vulnerability(CVE-2025-7415)
40. threat[10628]:Zimbra Collaboration Suite Denial of Service Vulnerability(CVE-2025-53645)
41. threat[10629]:Argo Project Argo CD Denial of Service Vulnerability(CVE-2025-59538)
42. threat[32661]:AnythingLLM data-import Access Control Error Vulnerability(CVE-2024-3279)
43. threat[32663]:Microsoft Exchange Server Spoofing Vulnerability(CVE-2025-25006)
44. threat[29579]:Jinhe OA CostPerApplyDetail.aspx SQL Injection Vulnerability
45. threat[29583]:Jinhe OA CostPerExpendDetail.aspx SQL Injection Vulnerability
46. threat[29581]:Gogs remote command injection vulnerability(CVE-2025-8110)
47. threat[29584]:Jinhe OA Company BudgetCollectEdit.aspx SQL Injection Vulnerability
48. threat[32664]:Langflow CORS Configuration Error Leading to Token Hijacking Vulnerability(CVE-2025-34291)
49. threat[32665]:Jinhe OA AjaxForBudgetDecompose.ashx SQL Injection Vulnerability
50. threat[29586]:JetBrains TeamCity Cross-Site Scripting Injection Vulnerability (CVE-2025-52877)
51. threat[32666]:my-springsecurity-plus SQL Injection Vulnerability(CVE-2024-6679)
52. threat[42588]:AgentTesla Trojan FTP Communication
53. threat[42589]:AgentTesla Trojan SMTP Communication


update rules:

1. threat[25062]:Apache OFBiz XMLRPC Insecure Deserialization(CVE-2020-9496)
2. threat[26734]:Apache OFBiz XML-RPC Deserialization Vulnerability (CVE-2023-49070)
3. threat[26849]:Apache OFBiz groovy Remote Code Execution Vulnerability(CVE-2023-51467)
4. threat[27050]:Apache OFBiz Path Traversal Vulnerability (CVE-2024-25065)
5. threat[27376]:Apache OFBiz Path Traversal Leads to RCE Vulnerability (CVE-2024-36104/CVE-2024-32113)
6. threat[27823]:Apache OFBiz Remote Code Execution Vulnerability (CVE-2024-38856)
7. threat[29515]:React Server Components Remote Code Execution Vulnerability (CVE-2025-55182/CVE-2025-66478)
8. threat[32608]:Turbomail Mailmain Sensitive Information Leakage Vulnerability
9. threat[49013]:Mining program connects mine pool server communication
10. threat[31510]:HTTP SQL Injection Attempt(Other)
11. threat[62201]:HTTP SQL Injection Attempt (Boolean blind injection)
12. threat[25470]:Malware Mining ETHMiner Obtains Mining Tasks
13. threat[41863]:Malware Mining ETHMiner Submits Mining Task
14. threat[28824]:Cacti Arbitrary File Creation Leads to Remote Code Execution Vulnerability(CVE-2025-24367)
15. threat[29475]:pgAdmin4 Remote Code Execution Vulnerability(CVE-2025-12762)
16. threat[27205]:Apache Kafka UI Command Injection Vulnerability (CVE-2023-52251)
17. threat[28961]:Grafana Cross-Site Scripting Injection Vulnerability (CVE-2025-4123)
18. threat[42211]:Windows/Linux system Shell reverse connection (TCP_2)
19. threat[42147]:HTTP Sensitive Parameters Execute Arbitrary Command Attempt



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.43205. The new/improved rules of this upgrade package are:

new rules:

1. threat[42572]:Patchwork StreamSpy Trojan TLS Communication
2. threat[42573]:Patchwork StreamSpy Trojan Information Collection_HTTP
3. threat[42574]:Patchwork StreamSpy Trojan Heartbeat_HTTP
4. threat[42576]:Patchwork Spyder Downloader Variant HTTP Communication
5. threat[29536]:OpenEMR Storage-Type Cross-Site Scripting Vulnerability (CVE-2025-43860)
6. threat[29537]:Tianrui Green Shield Approval System findUserPage.do SQL Injection Vulnerability (CVE-2025-11315)
7. threat[29538]:Yonyou U9Cloud FinancialIndexWebService Inscure Deserialization Vulnerability
8. threat[32638]:Apache Kylin downloadMetadataBackTmpFile Arbitrary File Read Vulnerability(CVE-2025-61734)
9. threat[29540]:Jinhe OA ReportParaList.aspx SQL Injection Vulnerability
10. threat[29541]:JetBrains TeamCity Cross-Site Scripting Injection Vulnerability (CVE-2025-52876)
11. threat[29560]:Freepbx File Upload Vulnerability (CVE-2025-61678)
12. threat[29542]:LibreNMS Alert Rule Stored Cross-Site Scripting Vulnerability(CVE-2025-62412)
13. threat[29543]:LibreNMS Alert Transport Stored Cross-Site Scripting Vulnerability(CVE-2025-62411)
14. threat[29544]:Samsung MagicINFO 9 Server Arbitrary File Upload Vulnerability(CVE-2025-54442)
15. threat[32639]:One-API Storage-Based Cross-Site Scripting Vulnerability(CVE-2025-3801)
16. threat[32641]:ChuanhuChatGPT Information Disclosure Vulnerability(CVE-2024-8613)
17. threat[32640]:XBoot Platform Server Side Request Forgery Vulnerability (CVE-2025-8527)
18. threat[29545]:Netgate pfSense haproxy_stats.php Reflected Cross-Site Scripting Vulnerability(CVE-2025-34172)
19. threat[29546]:Samsung MagicINFO 9 Server zipExtract File Upload Vulnerability(CVE-2025-54439)
20. threat[29547]:Microsoft Windows URL WorkingDirectory Directory Traversal Vulnerability(CVE-2025-33053)
21. threat[29549]:NI DAQExpress BinaryArrayParser Insecure Deserialization Vulnerability (CVE-2024-12741)
22. threat[29548]:Zimbra Collaboration Server Stored Cross-Site Scripting Vulnerability(CVE-2025-27915)
23. threat[32642]:React Server Components Source Code Leak Vulnerability(CVE-2025-55183)
24. threat[10625]:React Server Components Denial of Service Vulnerability (CVE-2025-55184/CVE-2025-67779)
25. threat[29550]:OpenEMR Stored Cross-Site Scripting Vulnerability (CVE-2025-31121)
26. threat[29551]:Jinhe OA BorrowShow.aspx SQL Injection Vulnerability
27. threat[29552]:Ivanti Endpoint Manager Arbitrary File Upload Vulnerability(CVE-2025-9872)
28. threat[32643]:ZZCMS System SQL Injection Vulnerability (CVE-2025-0565)
29. threat[32644]:Xufan EasyCVR Video Management Platform Sensitive Information Leakage Vulnerability(CVE-2025-1595)
30. threat[29553]:Next.js Permission Bypass Vulnerability (CVE-2024-51479)
31. threat[29555]:LocalAI Arbitrary File Write Vulnerability(CVE-2024-6868)
32. threat[42577]:Kryptik Trojan HTTP Communication
33. threat[42578]:GuLoader Trojan HTTP Communication
34. threat[42579]:AgentTesla Trojan HTTP Communication
35. threat[42580]:NetSupport Manager RAT HTTP Communication
36. threat[42581]:Adylkuzz Mining Botnet HTTP Communication
37. threat[29554]:UNACMS PHP Object Injection Vulnerability (CVE-2025-32101)
38. threat[32645]:SonicWALL SMA100 Directory Traversal Vulnerability (CVE-2025-32821)
39. threat[32646]:Weaver E-Office SignatureDel.php SQL Injection Vulnerability
40. threat[29556]:Weaver E-Office upload.php arbitrary file upload vulnerability
41. threat[29557]:FineReport export/excel front-end SQL Injection Vulnerability
42. threat[32647]:Freepbx Multi-Interface SQL Injection Vulnerability (CVE-2025-61675)
43. threat[42582]:Wacatac Trojan C2 Communication
44. threat[42583]:Dynamer Trojan C2 Communication
45. threat[42584]:Gh0st RAT C2 Communication
46. threat[42585]:ChaChi RAT C2 Communication
47. threat[42586]:Lumma RAT C2 Communication
48. threat[32648]:SonicWALL SMA100 Directory Traversal Vulnerability (CVE-2025-32819)
49. threat[32649]:Tianrui Green Shield Approval System exportDate.do Arbitrary File Reading Vulnerability
50. threat[29558]:Adobe ColdFusion Development Platform Command Injection Vulnerability (CVE-2025-43562)
51. threat[10626]:Bentoml Multipart Boundary Denial of Service Vulnerability(CVE-2024-9056)
52. threat[32650]:Kingdee OA SearchExcerptStation.aspx XXE and SQL Injection Vulnerabilities
53. threat[32651]:Jinhe OA SearchExcerptStation.aspx XXE and SQL Injection Vulnerabilities


update rules:

1. threat[28715]:Vllm pickle Deserialization Vulnerability(CVE-2024-9052/CVE-2025-32444)
2. threat[29280]:Samsung MagicINFO 9 Server Security Vulnerability(CVE-2025-4632)
3. threat[27119]:Apache Zeppelin shell Arbitrary Command Execution Vulnerability (CVE-2024-31861)
4. threat[28896]:Craft CMS Remote Code Execution Vulnerability(CVE-2025-32432)
5. threat[29477]:AstrBot Remote Code Execution Vulnerability (CVE-2025-55449)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.43115. The new/improved rules of this upgrade package are:

new rules:

1. threat[32618]:Yonyou U8 CRM help2 Arbitrary File Reading Vulnerability
2. threat[32619]:Adobe ColdFusion Path Traversal Vulnerability (CVE-2025-43566)
3. threat[29516]:Ivanti Endpoint Manager Mobile Remote Command Injection Vulnerability (CVE-2025-6771)
4. threat[32620]:ZOHO Manageengine Adselfservice Plus SQL Injection Vulnerability(CVE-2025-3833)
5. threat[32621]:Label Studio Server-Side Request Forgery Vulnerability(CVE-2025-25297)
6. threat[42569]:Coder Code-Server Credential Theft Vulnerability (CVE-2025-47269)
7. threat[29517]:BoltCMS Remote Code Execution Vulnerability(CVE-2025-34086)
8. threat[32622]:Jinhe OA C6 ArchivesAdviceAdd.aspx SQL Injection Vulnerability
9. threat[32623]:Jinhe OA C6 acceptvalue.aspx XML External Entity Injection Vulnerability
10. threat[32624]:Yonyou GRP-A++ selectdatasourceinfo sensitive Information Disclosure Vulnerability
11. threat[29518]:WordPress ACF-Extended Plugin Arbitrary User Creation Vulnerability(CVE-2025-13486)
12. threat[42570]:PurpleFox Malware TCP Communication
13. threat[32625]:Fortinet Fortiweb Path Traversal Vulnerability (CVE-2025-25254)
14. threat[29520]:Librenms Poller Group Name Stored-Type Cross-Site Scripting Vulnerability (CVE-2025-47931)
15. threat[29521]:Progress Loadmaster Command Injection Vulnerability (CVE-2024-56132)
16. threat[29522]:Tianrui Green Shield Approval System findModulePage.do SQL Injection Vulnerability (CVE-2025-11312)
17. threat[29523]:NI G Web Development gwebproject File Parsing Deserialization Vulnerability (CVE-2024-12742)
18. threat[32626]:HPE Insight Remote Support Path Traversal Vulnerability (CVE-2025-37098)
19. threat[29524]:Microsoft Configuration Manager SyncToken SQL Injection Vulnerability(CVE-2025-55320)
20. threat[32627]:Tianrui Green Shield Approval System downFileByconfirm.do Arbitrary File Reading Vulnerability
21. threat[32628]:ShiKong Zhiyou Enterprise Process Control System getStudioFile Arbitrary File Read Vulnerability
22. threat[32629]:ShiKong Zhiyou Enterprise Process Control System startUpdateStudio XML External Entity Injection Vulnerability
23. threat[32630]:JinheOA SetKPILevelXml.aspx XML External Entity Injection (XXE) Vulnerability
24. threat[32631]:StarNet Ruijie DMB-BS-taskexport.jsp Information Disclosure Vulnerability
25. threat[32632]:Xwiki Platform SQL Injection Vulnerability (CVE-2025-32969)
26. threat[29519]:FlowiseAI Flosise file upload vulnerability (CVE-2025-61687)
27. threat[29525]:Advantech iView SQL Injection Vulnerability(CVE-2025-52577)
28. threat[29527]:Samba Pre-authentication Command Injection Vulnerability(CVE-2025-10230)
29. threat[29526]:Tenray Green Shield Approval System findTenantPage.do SQL Injection Vulnerability
30. threat[29528]:Joomla SQL Vulnerability(CVE-2025-22206)
31. threat[29529]:Tianrui Green Shield Approval System addUpFile.do Arbitrary File Upload Vulnerability
32. threat[32633]:Jinhe OA SelectStation.aspx SQL Injection Vulnerability
33. threat[32634]:Joomla JS Jobs plugin 1.4.2 SQL Injection Vulnerability
34. threat[29532]:WordPress plugin Pie Register 安全漏洞(CVE-2025-34077)
35. threat[29533]:Grav Server-Side Template Injection (SSTI) Vulnerability (CVE-2025-66294/CVE-2025-66301)
36. threat[29530]:Cacti SNMP Remote Command Injection Vulnerability (CVE-2025-66399)
37. threat[29531]:ChanCMS Remote Code Execution Vulnerability (CVE-2025-8266)
38. threat[32635]:Django FilteredRelation SQL Injection Vulnerability (CVE-2025-13372)
39. threat[32636]:WordPress plugin Ads Pro local file Inclusion Vulnerability(CVE-2025-4380)
40. threat[42571]:Goldoon Botnet Online_TCP
41. threat[32637]:WordPress Post SMTP Plugin Email Log Disclosure Vulnerability(CVE-2025-11833)
42. threat[29535]:OpenEMR Stored Cross-Site Scripting Vulnerability (CVE-2025-32794)
43. threat[29534]:Milvus Proxy Hardcoded Credentials Lead to Identity Bypass Vulnerability (CVE-2025-64513)


update rules:

1. threat[29515]:React Server Components Remote Code Execution Vulnerability (CVE-2025-55182/CVE-2025-66478)
2. threat[28921]:F5 BIG-IP iControl REST Command Injection Vulnerability(CVE-2025-31644)
3. threat[49065]:YonYou NC Multiple Interface XXE Vulnerability
4. threat[29223]:WinRAR Directory Traversal Vulnerability (CVE-2025-8088)
5. threat[24255]:Web Service Remote Command Execution Attack
6. threat[29421]:Microsoft Windows Server Update Service Remote Code Execution Vulnerability(CVE-2025-59287)
7. threat[32454]:WordPress plugin Kubio AI Page Builder Path Traversal Vulnerability (CVE-2025-2294)
8. threat[28904]:Erlang/OTP SSH Remote Code Execution Vulnerability(CVE-2025-32433)
9. threat[42454]:Suspected HTTP Requests Exists XSS Injection Common Event Function
10. threat[30795]:YonYou NC IUpdateService XXE Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.43026. The new/improved rules of this upgrade package are:

new rules:

1. threat[29513]:Yonyou NC deleteEvent SQL injection vulnerability
2. threat[32617]:Jinhe OA Jhsoft.Web.blog/XmlHttp.aspx SQL Injection Vulnerability
3. threat[29514]:KUNBUS Revolution Pi Arbitrary User Login Vulnerability (CVE-2025-41646)
4. threat[29515]:React Server Components Remote Code Execution Vulnerability (CVE-2025-55182/CVE-2025-66478)
5. threat[42568]:Patchwork Spyder Downloader HTTP Communication
6. threat[24815]:Centreon ServerConnectionConfigurationService.php Command Injection(CVE-2020-9463)


update rules:

1. threat[28896]:Craft CMS Remote Code Execution Vulnerability(CVE-2025-32432)
2. threat[24255]:Web Service Remote Command Execution Attack
3. threat[25752]:Linux Information Collection Command Execution Success
4. threat[26101]:Yonyou NC uncancelEvent SQL Injection Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.43006. The new/improved rules of this upgrade package are:

new rules:

1. threat[32608]:Turbomail Mailmain Sensitive Information Leakage Vulnerability
2. threat[29495]:GeoServer XML External Entity Injection Vulnerability(CVE-2025-58360)
3. threat[29496]:Nagios Log Server Command Injection Vulnerability (CVE-2025-34322)
4. threat[29497]:Jinhe OA BITypeEdit.aspx SQL Injection Vulnerability
5. threat[29498]:Tianrui Green Shield Approval System findPropertyPage.do SQL Injection Vulnerability
6. threat[42563]:Orcus Remote Control Trojan C2 Communication Behavior
7. threat[29499]:Youjia Changjie Management System Attachment.ashx Arbitrary File Reading Vulnerability
8. threat[42564]:Silenttrinity Remotely Control Trojan TLS Communication Behavior
9. threat[29501]:Grafana SCIM Privilege Escalation Vulnerability (CVE-2025-41115)
10. threat[29502]:Apache Dubbo Unauthorized Bypass Vulnerability (CNVD-2023-96546)
11. threat[32609]:Jiahui Video Conferencing attachment Arbitrary File Read Vulnerability
12. threat[29503]:NETGEAR R9000 Authentication Bypass Leading to Command Execution Vulnerability(CVE-2019-20760)
13. threat[32611]:Tongxiang Human Resources Management System TXEHR PeiXun.asmx SQL Injection Vulnerability
14. threat[32610]:Label Studio Path Traversal Vulnerability(CVE-2025-25295)
15. threat[29504]:Label Studio Cross-site Scripting Vulnerability(CVE-2024-26152)
16. threat[29505]:Label Studio XSS Vulnerability(CVE-2024-23633)
17. threat[29506]:Simogeo Filemanager Arbitrary File Upload Vulnerability (CVE-2025-46001)
18. threat[29507]:Simogeo Filemanager Arbitrary File Upload Vulnerability (CVE-2025-46001)_1
19. threat[29500]:vLLM Completions API Out-of-Bounds Write Vulnerability(CVE-2025-62164)
20. threat[29508]:Yonyou NC initialOption SQL injection vulnerability
21. threat[32612]:Ollama File Existence Disclosure Vulnerability(CVE-2024-39722)
22. threat[42565]:Donot Remote Control Trojan TLS Communication Behavior
23. threat[25814]:Webmin Cross-site Request Forgery Vulnerability(CVE-2021-31760/CVE-2021-31762)
24. threat[42566]:Oceanlotus Remote Control Trojan TLS Communication Behavior
25. threat[29509]:Yonyou NC updateSelectedSharingUser SQL injection vulnerability
26. threat[29511]:Yonyou NC updateSharedEventColor SQL injection vulnerability
27. threat[32614]:Jinhe OA ReportSetting.aspx SQL Injection Vulnerability
28. threat[32613]:Code-Projects Wazifa System SQL Injection Vulnerability (CVE-2025-8438)
29. threat[32615]:JinheOA C6 CheckPwd.aspx XML External Entity Injection Vulnerability
30. threat[42567]:Valley RAT Downloader TCP Communication
31. threat[32616]:Flowise SQL Injection Vulnerability(CVE-2025-29189)
32. threat[29512]:NodeBB User Profile About Me Stored-Type Cross-Site Scripting Vulnerability (CVE-2024-57041)


update rules:

1. threat[42454]:Suspected HTTP Requests Exists XSS Injection Common Event Function
2. threat[25084]:Elasticsearch Unauthorized Access Vulnerability
3. threat[25084]:Elasticsearch Unauthorized Access Vulnerability_1
4. threat[42382]:Panora Backdoor HTTP Traffic Signaling
5. threat[21279]:Microsoft SharePoint 'EditForm.aspx' Script Injection Vulnerability（MS11-074）
6. threat[28447]:HTTP Python Code Execution Type Two
7. threat[21288]:Microsoft SharePoint Contact Details Cross Site Scripting Vulnerability(MS11-074)(CVE-2011-1891)
8. threat[62917]:HP SiteScope Administration Interface Security Bypass Vulnerability
9. threat[20615]:PAJAX pajax_call_dispatcher.php Remote Code Execution
10. threat[26982]:ScreenConnect AuthBypass Causes RCE(CVE-2024-1709)
11. threat[26705]:Apache ActiveMQ Jolokia Remote Code Execution Vulnerability (CVE-2022-41678)
12. threat[27786]:Zhenyun SRM Cloud Platform Public SpEL Expression Injection Vulnerability
13. threat[25930]:Oracle E-Business Suite Unauthenticated RCE(CVE-2022-21587)
14. threat[22722]:Apache Struts2 Remote Command Execution(CVE-2013-1966)(S2-013)
15. threat[27079]:Ray DashBoard API Unauthorized Command Execution Vulnerability(CVE-2023-48022)
16. threat[42094]:Anishell Webshell Upload
17. threat[31880]:Jeecg-Boot queryUserComponentData SQL Injection Vulnerability(CVE-2022-22881)
18. threat[25316]:Jenkins Build With Parameters Plugin Stored Cross Site Scripting Vulnerability(CVE-2021-21628)
19. threat[25314]:Jenkins Artifact Repository Parameter Plugin Stored Cross Site Scripting Vulnerability(CVE-2021-21622)
20. threat[26873]:Dahua Smart Park Integrated Management Platform poi Arbitrary File Upload Vulnerability
21. threat[28933]:Ivanti Endpoint Manager Mobile Authentication Bypass and Remote Code Execution Vulnerability(CVE-2025-4427/CVE-2025-4428)
22. threat[23830]:Centreon Web Useralias Command Execution Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.42920. The new/improved rules of this upgrade package are:

new rules:

1. threat[42556]:Discovery RDP Protocol Scanning Behavior
2. threat[32596]:Landray EIS Intelligent Assistance Platform mobileposition.aspx SQL Injection Vulnerability
3. threat[32597]:Landray EIS Intelligent Assistance Platform task_view.aspx SQL Injection Vulnerability
4. threat[32598]:Apache NiFi Information Disclosure Vulnerability(CVE-2024-56512)
5. threat[32600]:Jinhe OA ArchivesShowSendAip.aspx SQL Injection Vulnerability
6. threat[32599]:Jinhe OA Examinenodsingletonxml.aspx XXE Vulnerability
7. threat[32601]:Wegia Cross-Site Scripting Vulnerability (CVE-2025-55170)
8. threat[29478]:Jinhe OA ArchivesShowAsk.aspx SQL Injection Vulnerability
9. threat[29479]:West Digital NAS Google_Analytics.Php Command Execution Vulnerability
10. threat[42558]:MuddyWater Phoenix Backdoor C2 Communication
11. threat[42559]:MuddyWater UDPGangster Backdoor UDP Communication
12. threat[29480]:Jinhe OA ArchivesShowAskAipAip.aspx SQL Injection Vulnerability
13. threat[32602]:Dongsheng Logistics Software WmsRateLCLGridSource.aspx SQL Injection Vulnerability
14. threat[42557]:Discovery SIP Protocol Scanning Behavior
15. threat[42560]:Detected Expanse Scanning Behavior
16. threat[29482]:Dify Upload Server Requests Forged SSRF Vulnerability
17. threat[42561]:NukeSped Backdoor Online
18. threat[42562]:NukeSped Backdoor Command Execution
19. threat[32603]:Phpgurukul Small CRM SQL Injection Vulnerability (CVE-2025-11053)
20. threat[29483]:JavaScript expr-eval Library Arbitrary Code Execution Vulnerability (CVE-2025-12735)
21. threat[29484]:ChuanhuChatGPT upload Arbitrary File Upload Vulnerability(CVE-2024-5982)
22. threat[29486]:Mingyuan ERP login/sso/login.aspx Authentication Bypass Vulnerability
23. threat[29485]:Thinkphp Cache File Inclusion Vulnerability (CVE-2025-63888)
24. threat[29487]:Cisco ASA/FTD VPN Unauthorized Access Vulnerability (CVE-2025-20362)
25. threat[29488]:Fortinet Fortiweb Command Injection Vulnerability (CVE-2025-58034)
26. threat[29489]:Oracle Identity Manager Remote Code Execution Vulnerability(CVE-2025-61757)
27. threat[32605]:Windows Remote Desktop Licensing Service Information Disclosure Vulnerability(CVE-2024-38258)
28. threat[32604]:PhotoPrism config Unauthorized Access Vulnerability
29. threat[50674]:Detected shadowserver echo Detection Behavior
30. threat[29490]:Jinhe OA AskAttachment.aspx SQL Injection Vulnerability
31. threat[29481]:Jinhe OA ArchivesShowSend.aspx SQL Injection Vulnerability
32. threat[32606]:Microsoft Windows Explorer Directory Traversal Vulnerability(CVE-2024-49082)
33. threat[29491]:Tianrui Green Shield Approval System findCategoryPage.do SQL Injection Vulnerability
34. threat[32607]:Anything-LLM Setup-Complete Sensitive Information Leakage Vulnerability(CVE-2024-6842)
35. threat[29493]:Flyrise FE Enterprise Management Platform mobileKey Interface Arbitrary User Login Vulnerability
36. threat[29494]:Flyrise FE Enterprise Management Platform ChangeBGServlet Interface Arbitrary File Upload Vulnerability



update rules:

1. threat[42331]:Raccoon Stealer C2 Communication
2. threat[32536]:Microsoft Windows File Explorer Spoofing Vulnerability(CVE-2025-24071)
3. threat[27600]:Ollama Remote Code Execution Vulnerability (CVE-2024-37032/CVE-2025-44779)
4. threat[42549]:MystRodX Backdoor TCP Communication
5. threat[42551]:Pickai Backdoor Online
6. threat[31367]:Apache Tomcat Information Leakage Vulnerability (CVE-2024-21733)
7. threat[27866]:Windows Remote Desktop Authorization Service Remote Code Execution Vulnerability (CVE-2024-38074/CVE-2024-38076/CVE-2024-38077)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.42841. The new/improved rules of this upgrade package are:

new rules:

1. threat[32586]:Ruvar RuvarHRM.Web.Common.ashx SQL Injection Vulnerability
2. threat[32585]:GNU Mailman Directory Traversal Vulnerability (CVE-2025-43919)
3. threat[29457]:Huatian Software Inforcenter PLM uploadFileHttp Any File Upload Vulnerability
4. threat[32588]:Vinda CRM AccountSelect.jsp SQL Injection Vulnerability
5. threat[32587]:Smart Interconnec WMS getsyspdaversionlistbyparams SQL Injection Vulnerability
6. threat[42548]:MystRodX Backdoor Online
7. threat[42549]:MystRodX Backdoor TCP Communication
8. threat[29460]:Kingdee K3 Financial Software System MOBFileUpload Arbitrary File Upload Vulnerability
9. threat[29459]:ICTBROADCAST Unauthenticated Cookie Remote Code Execution Vulnerability(CVE-2025-2611)
10. threat[29463]:Sobe Media Convergence /sobey-mchEditor/mch/Articlelist/articleExamineExport SQL Injection Vulnerability
11. threat[29462]:Satori Botnet ADB Debug Interface Probing Behavior
12. threat[32589]:Flux WMS getDownloadFileAction Arbitrary File Reading Vulnerability
13. threat[29461]:HoverFly Remote Code Execution Vulnerability (CVE-2025-54123)
14. threat[32590]:Jinhe OA ArchivesRoomDeptSave.aspx XXE Vulnerability
15. threat[32591]:Oriental Century AllRWFRInfo SQL Injection Vulnerability
16. threat[29464]:Fumeng Cloud CRM AjaxCustomizeReport.ashx SQL Injection Vulnerability
17. threat[42553]:VtoolBot Botnet C2 Communication
18. threat[32592]:JinheOA ExcerptAppraiseSet.aspx XML External Entity Injection(XXE) Vulnerability
19. threat[42550]:Remcos RAT Online
20. threat[42551]:Pickai Backdoor Online
21. threat[42552]:Pickai Backdoor TCP Communication
22. threat[42554]:Loki C2 Tool Communication Behavior
23. threat[32593]:Fortinet FortiWeb Path Traversal Vulnerability (CVE-2025-64446)
24. threat[29467]:XWiki Admin Tools CSRF Command Execution Vulnerability(CVE-2023-48292)
25. threat[32594]:CrushFTP Directory Traversal Vulnerability (CVE-2025-32103)
26. threat[29465]:CrushFTP SSRF Vulnerability(CVE-2025-32102)
27. threat[42555]:IcedID Trojan C2 Communication
28. threat[29468]:Next.Js Middleware SSRF Vulnerability (CVE-2025-57822)
29. threat[32595]:XWiki Path Traversal Vulnerability (CVE-2025-55747)
30. threat[29470]:Jinhe OA ArchivesRoomUpdate.aspx SQL Injection Vulnerability
31. threat[29472]:Jinhe OA ArchivesShowAcceptAip.aspx SQL Injection Vulnerability
32. threat[29471]:WordPress plugin TI WooCommerce Wishlist Arbitrary File Upload Vulnerability (CVE-2025-47577)
33. threat[29473]:Ikonomos Skyvern Server Template Injection Vulnerability (CVE-2025-49619)
34. threat[29469]:TongWeb ejbserver/ejb Insecure Deserialisation Vulnerability
35. threat[29474]:Sangfor Operations and Maintenance Security Management System portal_login Remote Command Execution Vulnerability(CVE-2025-12916)
36. threat[29475]:pgAdmin4 Remote Code Execution Vulnerability(CVE-2025-12762)
37. threat[29476]:Western Digital NAS snmp_mgr.cgi Command Execution Vulnerability
38. threat[29477]:AstrBot Remote Code Execution Vulnerability (CVE-2025-55449)


update rules:

1. threat[42248]:Patchwork APT Protego Remote Control Trojan Online Request
2. threat[42249]:Patchwork APT Protego Remote Control Trojan Upload Host Information
3. threat[42250]:Patchwork APT Protego Remote Control Trojan Upload Host Application Information
4. threat[42252]:Patchwork APT Protego Remote Control Trojan Send dir Command Result
5. threat[42254]:Patchwork APT Protego Remote Control Trojan download Instruction Download file
6. threat[49013]:Mining program connects mine pool server communication
7. threat[41543]:Trojan/Backdoor General ASP trojan
8. threat[41544]:Trojan/Backdoor General JSP trojan Files Upload
9. threat[42147]:HTTP Sensitive Parameters Execute Arbitrary Command Attempt
10. threat[28704]:Apache Tomcat Remote Code Execution Vulnerability_1 (CVE-2025-24813)
11. threat[42312]:Cobalt Strike TaoWu Reverse HTTP C2 Communication
12. threat[42270]:AtlasCross APT Send Malicious Macro Document
13. threat[42222]:Lumma Stealer Trojan Negotiating Configuration Information
14. threat[42223]:Lumma Stealer Trojan Sends Cryptic Messages
15. threat[42260]:Lazarus APT Andariel Sample Connects C2
16. threat[42463]:Lazarus APT Uses MagicRAT For C2 Communication
17. threat[26112]:HTTP SQL Time Blind Injection Attempt
18. threat[29390]:Yonyou U8cloud pubsmsservlet Deserialisation Vulnerability
19. threat[29156]:CentOS Web Panel Remote Code Execution Vulnerability (CVE-2025-48703)
20. threat[32031]:Zabbix api_jsonrpc.php SQL Injection Vulnerability(CVE-2024-36465)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.42760. The new/improved rules of this upgrade package are:

new rules:

1. threat[10624]:Anything-llm data-exports Unauthenticated Denial of Service Vulnerability(CVE-2024-22422)
2. threat[29451]:Tenda AC6 Buffer Overflow Vulnerability(CVE-2025-50263)
3. threat[32578]:FuMeng Cloud CRM AjaxProductFiled.ashx SQL Injection Vulnerability
4. threat[42538]:Amadey Trojan C2 Communication
5. threat[42539]:Amadey Trojan DNS Request Connection
6. threat[42540]:Amadey Trojan Send Stolen Information
7. threat[32579]:Parking Lot Back-end Management System LaneMonitor/GetVideo SQL Injection Vulnerability
8. threat[32580]:Pytorch-lightning upload_file File Upload Vulnerability(CVE-2024-4476)
9. threat[29452]:Yonyou NC saveProDefServlet XML Entity Injection Vulnerability
10. threat[42541]:Mirai Botnet DNS Request Connection
11. threat[42542]:HaliBot Botnet DNS Request Connection
12. threat[42543]:HaliBot Botnet Online
13. threat[42544]:RapperBot Botnet C2 Communicate
14. threat[29453]:Open Webui Arbitrary Code Execution Vulnerability (CVE-2025-64495)
15. threat[32581]:WordPress AI Engine Plugin Token Leak Vulnerability (CVE-2025-11749)
16. threat[32582]:WordPress plugin Newsletters SQL Injection Vulnerability (CVE-2025-30921)
17. threat[32583]:JeeWMS cgFormBuildController.do SQL Injection Vulnerability
18. threat[29454]:Monsta FTP Arbitrary File Upload Vulnerability (CVE-2025-34299)
19. threat[29455]:Fumeng Cloud CRM AjaxProductTemplateList.ashx SQL Injection Vulnerability
20. threat[42545]:Phorpiex Botnet C2 Communication
21. threat[42546]:Phorpiex Botnet HTTP Communication
22. threat[42547]:Phorpiex Botnet TCP Communication
23. threat[29456]:Microsoft Visual Studio GitHub Copilot plugin prompt Command Injection Vulnerability (CVE-2025-53773)
24. threat[32584]:Sobe Converged Media Platform catalogArticles SQL Injection Vulnerability
25. threat[32574]:Jinhe OA AccountSecurityForPhone.aspx SQL Injection Vulnerability
26. threat[29443]:WordPress SureTriggers Plugin Arbitrary User Creation Vulnerability (CVE-2025-3102)
27 threat[29445]:Fumeng Cloud CRM GetDropDownListContent.ashx SQL Injection Vulnerability
28. threat[29444]:Docker Compose Path Traversal Vulnerability (CVE-2025-62725)
29. threat[32575]:Zhongshi Cloud Platform sys_user_list Interface Information Disclosure Vulnerability
30. threat[29438]:H3C Multiple Product Injection Vulnerability (CVE-2025-3539/CVE-2025-3540/CVE-2025-3541/CVE-2025-3542/CVE-2025-3543/CVE-2025-3544/CVE-2025-3545/CVE-2025-3546)
31. threat[32576]:Jinhe OA SubjectEdit.aspx SQL Injection Vulnerability
32. threat[42537]:vshell C2 Tool Connection Communication_2
33. threat[29447]:Jinhe OA ImportXml.aspx XML External Entity Injection(XXE) Vulnerability
34. threat[32577]:Tianrui Green Shield Approval System findUserPage Interface Information Disclosure Vulnerability
35. threat[29448]:WordPress plugin User Registration and Membership Unverified Privilege Escalation Vulnerability (CVE-2025-2563)
36. threat[29449]:Jinhe OA MenuSort.aspx SQL Injection Vulnerability
37. threat[10623]:H3C GR-5400AX security vulnerability (CVE-2025-5156)


update rules:

1. threat[41060]:Trojan/Backdoor General PHP trojan
2. threat[25079]:Oracle WebLogic Server Remote Code Execution Vulnerability(CVE-2020-14882/CVE-2020-14883)
3. threat[29421]:Microsoft Windows Server Update Service Remote Code Execution Vulnerability(CVE-2025-59287)
4. threat[26243]:YonyouNC ContactsFuzzySearchServlet Deserialization Vulnerability
5. threat[26253]:YonyouNC UserSynchronizationServlet Deserialization Vulnerability
6. threat[26245]:YonYouNC ContactsQueryServiceServlet Deserialization Vulnerability
7. threat[28735]:Metasploit Meterpreter linux/x64/meterpreter_reverse_http Trojan Connection Attempts
8. threat[28502]:Landray EKP System fsscCommonPortlet.do SQL Injection Vulnerability
9. threat[25428]:Microsoft Windows Print Spooler Code Execution Vulnerability(CVE-2021-34527)
10. threat[27816]:Xinhua OA System index SQL Injection Vulnerability
11. threat[28299]:AntSword Webshell Management Tool Connection and Control_3
12. threat[29348]:Spring Cloud Gateway Information Disclosure Vulnerability (CVE-2025-41243/CVE-2025-41253)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.42689. The new/improved rules of this upgrade package are:

new rules:

1. threat[32557]:RedSail iOffice MobileBind.aspx SQL Injection Vulnerability
2. threat[32558]:Jinher OA AppraiseStationSetUpdate.aspx SQL Injection Vulnerability
3. threat[42535]:BITTER WmRAT RAT C2 Communication_HTTP
4. threat[32559]:Apache Tomcat Path Traversal Vulnerability (CVE-2025-55752)
5. threat[32560]:Vite Information Disclosure Vulnerability (CVE-2025-46565)
6. threat[32561]:Jinher OA AppraiseScoreUpdate.aspx SQL Injection Vulnerability
7. threat[29432]:Jinhe OA BookUpdate.aspx SQL Injection Vulnerability
8. threat[29433]:Jinhe OA KpiWhetherExistTemplateKpiXml.aspx SQL Injection Vulnerability
9. threat[29434]:LMSYS SGLANG Pickle Deserialisation Vulnerability (CVE-2025-10164)
10. threat[32562]:Feiqi Interconnect Enterprise Operation Management Platform Attachment Arbitrary File Read Vulnerability
11. threat[32563]:FuMeng Cloud CRM AjaxSendDingdingMessage.ashx SQL Injection Vulnerability
12. threat[32564]:Jinher OA LoginModeAdvanced.aspx SQL Injection Vulnerability
13. threat[42536]:Patchwork BADNEWS Trojan Heartbeat Request
14. threat[29435]:Agentscope Deserialisation Vulnerability(CVE-2024-8502)
15. threat[32565]:Jinher OA OpenGroupOpen.aspx SQL Injection Vulnerability
16. threat[29436]:Salia PLCC check_req.php Remote Command Execution Vulnerability
17. threat[32566]:Yonyou NC cpRadarImage/download SQL Injection Vulnerability
18. threat[29437]:Fangzheng Media Editorial System getRemotePapers.do Authentication Bypass Vulnerability
19. threat[32568]:Sobe Media /sobey-mchEditor/mch/TestInt/reUploadBase64 SQL Injection Vulnerability
20. threat[32570]:FuMeng Cloud CRM LicManage.ashx SQL Injection Vulnerability
21. threat[32569]:Jinhe OA KpiTypeExamineXml.aspx XXE Vulnerability
22. threat[32567]:Weaver OA E-cology VerifyGDLogin Login Bypass Vulnerability
23. threat[32571]:Anything-llm stream-chat prisma injection Vulnerability(CVE-2024-8251)
24. threat[29439]:Hongjing Human Resources Information Management System upload Arbitrary File Read Vulnerability
25. threat[32572]:Nmap HTTP NTLM Service Scanning Behavior
26. threat[29441]:FoxCMS Remote Code Execution Vulnerability (CVE-2025-29306)
27. threat[10620]:Tenda RX3 Buffer Overflow Vulnerability (CVE-2025-29360)
28. threat[29440]:JEHC-BPM Code Execution Vulnerability(CVE-2025-45854)
29. threat[29442]:Tianrui Green Shield Approval System findRolePage.do SQL Injection Vulnerability
30. threat[32573]:Gradio Restricted File Reading Vulnerability(CVE-2024-12217)
31. threat[32543]:Dongsheng Logistics Software DsWebService.asmx Multiple SQL Injection Vulnerabilities


update rules:

1. threat[27752]:TOTOLINK NTPSyncWithHost Function Command Injection Vulnerability(CVE-2024-0296/CVE-2022-36479/CVE-2025-28034)
2. threat[27346]:Wanhu ezOFFICE FileTest File Upload Vulnerability
3. threat[42468]:APT-C-35 Spyder Downloader Collect Information
4. threat[32019]:Fastjson 1.2.73 - 1.2.80 Arbitrary File Read Vulnerability
5. threat[26271]:Fastjson 1.2.80 Deserialization Vulnerability (CVE-2022-25845)
6. threat[41969]:Fastjson Deserialization Vulnerability Detection
7. threat[26196]:Fastjson 1.2.60 Deserialization Vulnerability
8. threat[26194]:Fastjson 1.2.59 Deserialization Vulnerability
9. threat[26197]:Fastjson 1.2.61 Deserialization Vulnerability
10. threat[26153]:Fastjson 1.2.68 Deserialization Vulnerability
11. threat[26151]:Fastjson 1.2.66 Deserialization Vulnerability
12. threat[26149]:Fastjson 1.2.62 Deserialization Vulnerability
13. threat[26148]:Fastjson 1.2.47 Deserialization Vulnerability(CNVD-2019-22238)
14. threat[26147]:Fastjson 1.2.45 Deserialization Vulnerability
15. threat[26144]:Fastjson 1.2.41 Deserialization Vulnerability
16. threat[26140]:Fastjson 1.2.24 Deserialization Vulnerability(CNVD-2017-02833)
17. threat[42367]:OceanLotus Uses MST To Deliver Remote Trojan
18. threat[28233]:CyberPanel upgrademysqlstatus Remote Code Execution Vulnerability(CVE-2024-51567)
19. threat[42365]:Patchwork APT BADNEWS Trojan C2 Communication
20. threat[42494]:Patchwork Launched Remote Control Trojan Sample Based on Mythic C2_Online
21. threat[31112]:Wanhu OA downloadhttp.jsp Arbitrary File Download Vulnerability
22. threat[28223]:Apache Solr Authentication Bypass Vulnerability(CVE-2024-45216)
23. threat[26425]:Weaver ecology plaincall Login Bypass Vulnerability
24. threat[23992]:Microsoft IIS 6.0Remote Code Execution Vulnerability(CVE-2017-7269)
25. threat[62178]:HTTP SQL Injection Attempt(System Command Execution)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.42603. The new/improved rules of this upgrade package are:

new rules:

1. threat[29414]:WordPress Ditty Plugin SSRF Vulnerability(CVE-2025-8085)
2. threat[32556]:Hongjing eHR designateTask.do SQL Injection Vulnerability
3. threat[29415]:WordPress Stacks Mobile App Builder Plugin <= 5.2.3 Authentication Bypass Vulnerability(CVE-2024-50477)
4. threat[29417]:XWiki Wiki Remote Code Execution Vulnerability(CVE-2024-31983)
5. threat[29416]:Holographic AI Network Operations Platform ajax_cloud_router_config Command Execution Vulnerability
6. threat[32541]:ZKTime Attendance Management System iclock/ic1ock SQL Injection Vulnerability
7. threat[42518]:Jiao Yue Lian Internal Network Penetration Behavior
8. threat[29419]:XETUX Software dynamiccontent.properties.xhtml Remote Code Execution Vulnerability
9. threat[29420]:Dahua DSS SZFTService Remote Command Execution Vulnerability
10. threat[32542]:HID Vertx Controller Scanning Behavior
11. threat[29418]:Tenda AC6 Buffer Overflow Vulnerability(CVE-2023-24332)
12. threat[42519]:Natpass Internal Network Penetration Behavior
13. threat[29421]:Microsoft Windows Server Update Service Remote Code Execution Vulnerability(CVE-2025-59287)
14. threat[32554]:Jinpan Mobile Library Book Management System tabShow Information Leakage Vulnerability
15. threat[29422]:Framelink Figma MCP Server Remote Code Execution Vulnerability(CVE-2025-53967)
16. threat[32544]:Zhuangmeng Information Technology Home Improvement ERP Management System Budget.asmx SQL Injection Vulnerability(CNVD-2021-16879)
17. threat[32545]:Zhuangmeng Information Technology Home Improvement ERP Management System BaseInfo.asmx SQL Injection Vulnerability(CNVD-2021-16880)
18. threat[42520]:PoshC2 Remote Control Tool Communication - TLS
19. threat[29423]:PHP exec Remote Command Injection
20. threat[32546]:Cloud Space Time Business ERP System validateLoginName SQL injection vulnerability
21. threat[29424]:EOVA doInit Interface JDBC Deserialization Vulnerability
22. threat[29425]:NewCapec Palm Campus Service Management Platform /Api/V3/Login Arbitrary Command Execution Vulnerability
23. threat[29426]:Shenzhen Wanwang QuanXI AI Network Operation and Maintenance Platform Command Execution Vulnerability(CNVD-2021-50627)
24. threat[29427]:Wanhu OA freemarkeService Remote Command Execution Vulnerability
25. threat[29428]:Tongwang OA createFileByZip Arbitrary File Upload Vulnerability
26. threat[32548]:Tongda OA logincheck_new Unauthorized Vulnerability
27. threat[32547]:ZEIT Next.js Server-Side Request Forgery Vulnerability (CVE-2024-34351)
28. threat[32549]:Memos Server-Side Request Forgery Vulnerability (CVE-2025-22952)
29. threat[29429]:Ruijie SSL VPN Unauthorized Access Vulnerability(CNVD-2021-29185)
30. threat[32550]:Shanghai Powerpms Transfer.aspx Unauthorized Access Information Leakage Vulnerability
31. threat[32551]:Powerpms Reg.ashx SQL Injection Vulnerability
32. threat[32552]:Powerpms FileBrowserPdf.ashx SQL Injection Vulnerability
33. threat[29430]:Anshu Cloud Comprehensive Log Analysis System assetScanns Command Execution Vulnerability
34. threat[42525]:APT36 StealthServer Backedoor C2 Communication_TCP
35. threat[42526]:APT36 StealthServer Backedoor C2 Communication_HTTP_1
36. threat[42527]:APT36 StealthServer Backedoor C2 Communication_HTTP_2
37. threat[42528]:APT36 StealthServer Backedoor C2 Communication_WebSocket
38. threat[32555]:Navidrome Authentication Bypass Vulnerability (CVE-2025-27112)
39. threat[32553]:Powerpms GetFilesData SQL Injection Vulnerability
40. threat[29431]:Jinhe OA ImportGuide2Xml.aspx XML External Entity Injection(XXE) Vulnerability


update rules:

1. threat[29299]:WordPress InstaWP-Connect Plugin Arbitrary File Upload Vulnerability (CVE-2024-2667)
2. threat[27231]:XWiki.org XWiki Solr Space Facet Code Injection Vulnerability(CVE-2024-31984)
3. threat[31121]:HTTP SQL Injection Attempt (Database Fingerprinting Detection)
4. threat[25558]:ZZZCMS Remote Code Execution Vulnerability (CVE-2021-32605/CVE-2019-9041)
5. threat[50666]:Discover Tailscale Tools Communication
6. threat[42329]:HTTP request headers carry suspected command injection payloads
7. threat[29357]:Yonyou U8cloud NCCloudGatewayServlet Command Execution Vulnerability
8. threat[42510]:BITTER KiwiStealer Backdoor C2 Communication
9. threat[42147]:HTTP Sensitive Parameters Execute Arbitrary Command Attempt
10. threat[28239]:PHP Code Execution Attack - Generic Functions
11. threat[60245]:HTTP SQL Injection Attempt (Union Query Injection)
12. threat[29377]:Melis CMS Slider Module Arbitrary File Upload Vulnerability (CVE-2025-10353)
13. threat[32516]:Fortra GoAnywhere MFT Deserialization Vulnerability(CVE-2025-10035)
14. threat[28892]:D-Link Command Inject Vulnerability(CVE-2022-28573/CVE-2023-33735)
15. threat[41499]:HTTP Request Sensitive Path Access Attempt
16. threat[50652]:XML External Entity Injection (XXE)-(HTML Entity Encoding/UTF-16/UTF-7)
17. threat[41710]:Windows/Linux Shell Reverse Connect
18. threat[31510]:HTTP SQL Injection Attempt(Other)
19. threat[26112]:HTTP SQL Time Blind Injection Attempt
20. threat[25291]:Microsoft IIS HTTP Protocol Stack Remote Code Execution Vulnerability(CVE-2021-31166)
21. threat[32440]:Tongda OA /mysql/index.php Unauthorized Access Vulnerability
22. threat[28237]:PHP Code Execution Attack - Encoding
23. threat[32534]:PowerPMS OfficeService.aspx SSRF Vulnerability
24. threat[23818]:Spring Boot Framework SPEL Expressions Injection Vulnerability
25. threat[26145]:Fastjson 1.2.42 Deserialization Vulnerability
26. threat[26650]:Kingdee EAS loadTree JNDI Injection Vulnerability
27. threat[42244]:BITTER taskhostv Sample Send Host Information
28. threat[27215]:Ruiyou Tianyi Application Virtualization System appsave SQL injection Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.42497. The new/improved rules of this upgrade package are:

new rules:

1. threat[29394]:BentoML 1.4.3 Deserialization Vulnerability(CVE-2025-27520)
2. threat[32530]:Jinher OA GroupUserSynchState.aspx SQL Injection Vulnerability
3. threat[32531]:Jinher OA GroupOuterRegisterAdd.aspx SQL Injection Vulnerability
4. threat[32532]:Sim Studio AI Arbitrary File Reading Vulnerability(CVE-2025-9805)
5. threat[32533]:Jinhe OA GetWordFileName.aspx XML External Entity Injection (XXE) Vulnerability(CVE-2025-10816)
6. threat[42510]:BITTER KiwiStealer Backdoor C2 Communication
7. threat[29395]:LB-Link Unauthorized Command Injection Vulnerability (CVE-2025-57685)
8. threat[29396]:LB-LINK BL-AC2100 Security Vulnerability (CVE-2025-10773)
9. threat[29397]:Ruoyi-AI framework Arbitrary File Upload Vulnerability (CVE-2025-6466)
10. threat[42511]:BITTER RAT C2 Communication
11. threat[29398]:BigAntSoft BigAnt Office Messenger SQL Injection Vulnerability (CVE-2024-54761)
12. threat[10619]:H3C Magic B3 Buffer Overflow Vulnerability (CVE-2025-10942)
13. threat[32534]:PowerPMS OfficeService.aspx SSRF Vulnerability
14. threat[28972]:Flyrise FE Enterprise Management Platform Arbitrary File Upload Vulnerability
15. threat[42512]:BITTER MiyaRAT Backdoor C2 Communication_TCP
16. threat[29399]:Ankore Smart Environmental Cloud Platform uploadAttachment Arbitrary File Upload Vulnerability
17. threat[32536]:Microsoft Windows File Explorer Spoofing Vulnerability(CVE-2025-24071)
18. threat[32535]:Jinhe OA XML External Entity Injection Vulnerability (CVE-2025-11035)
19. threat[32537]:Stirling-PDF Server-Side Request Forgery Vulnerability (CVE-2025-55150)
20. threat[29402]:Ruijie EWEB Router control.php Remote Command Execution Vulnerability
21. threat[29403]:Weaver e-Mobile Mobile Management Platform error Remote Command Execution Vulnerability
22. threat[29405]:Panalog Log Audit System sessiptbl.php Frontend RCE Vulnerability
23. threat[42513]:Natapp Internal Network Penetration Behavior
24. threat[29407]:Western Digital NAS ftp_download.php Remote Command Execution Vulnerability
25. threat[29401]:Tianrui Green Shield Approval System uploadWxFile Arbitrary File Upload Vulnerability
26. threat[29404]:Glodon Linkworks GetAuthorizeKey.ashx Arbitrary File Upload Vulnerability
27. threat[29408]:Panalog Log Audit System sy_query.php RCE Vulnerability
28. threat[42514]:Peanut Shell PHTunnel Internal Network Penetration Behavior
29. threat[32539]:Laravel Framework Sensitive Information Disclosure Vulnerability (CVE-2024-29291)
30. threat[29406]:Jinhe OA AddressImportList.aspx XML Vulnerability
31. threat[32538]:Jinhe OA OuterAppTIDSave.aspx SQL Injection Vulnerability
32. threat[29409]:WordPress GutenKit Plugin Remote Code Execution Vulnerability (CVE-2024-9234)
33. threat[42515]:NKN nConnect Internal Network Penetration Behavior
34. threat[42517]:MyJSRat Remote Control Tool Get Payload
35. threat[29410]:Yeastar WebCGI Backend Remote Command Execution Vulnerability
36. threat[42516]:iepose Internal Network Penetration Behavior
37. threat[29412]:Jenkins Git Parameter Remote Command Execution Vulnerability(CVE-2025-53652)
38. threat[29411]:unibox checkstatus ping.php Command Execution Vulnerability
39. threat[29413]:Futong Tianxia Foreign Trade ERP UploadEmailAttr Arbitrary File Upload Vulnerability
40. threat[32540]:Yongyou CHANJET T+ Ufida.T.SM.UIP.MultiCompanySettingController,Ufida.T.SM.UIP.ashx SQL Injection Vulnerability
41. threat[42505]:BITTER ArtraDownloader C2 Communication_2
42. threat[29381]:Chaos Mesh Operating System Command Injection Vulnerability(CVE-2025-59358/CVE-2025-59359/CVE-2025-59360/CVE-2025-59361)


update rules:

1. threat[28880]:SAP NetWeaver Visual Composer Metadata Uploader Arbitrary File Upload Vulnerability (CVE-2025-31324)
2. threat[42505]:BITTER ArtraDownloader C2 Communication_2
3. threat[29381]:Chaos Mesh Operating System Command Injection Vulnerability(CVE-2025-59358/CVE-2025-59359/CVE-2025-59360/CVE-2025-59361)
4. threat[28299]:AntSword Webshell Management Tool Connection and Control_3
5. threat[42138]:Behinder 3.0 Webshell Connect
6. threat[29133]:AISHU Anyshare Intelligent Content Management Platform start_service|service_status|stop_service Remote Command Execution Vulnerability
7. threat[32477]:Ollama File Existence Disclosure Vulnerability(CVE-2024-39719)
8. threat[23397]:JBoss Seam Expression Language Remote Code Execution and Arbitrary File Upload
9. threat[29348]:Spring Cloud Gateway Information Disclosure Vulnerability (CVE-2025-41243)
10. threat[29380]:Oracle E-Business Suite Request Smuggling Vulnerability (CVE-2025-61882/CVE-2025-61884)
11. threat[29390]:Yonyou U8cloud pubsmsservlet Deserialisation Vulnerability
12. threat[28192]:NetMizer Log Management System hostdelay.php Command Execution Vulnerability
13. threat[41499]:HTTP Request Sensitive Path Access Attempt
14. threat[30805]:E-cology users.data Information Leakage Vulnerability
15. threat[28668]:XWiki Platform Remote Code Execution Vulnerability(CVE-2025-24893)
16. threat[27957]:Telecom Gateway Configuration Management System del_file.php Command Execution Vulnerability
17. threat[29271]:MyJSRat Remote Control Tool Communication
18. threat[62201]:HTTP SQL Injection Attempt (Boolean blind injection)
19. threat[42363]:Platypus TCP Communication



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.42394. The new/improved rules of this upgrade package are:

new rules:

1. threat[29377]:Melis CMS Slider Module Arbitrary File Upload Vulnerability (CVE-2025-10353)
2. threat[32517]:Wanhu ezEIP onlyvalid.aspx SQL Injection Vulnerability
3. threat[32516]:Fortra GoAnywhere MFT Deserialization Vulnerability(CVE-2025-10035)
4. threat[29378]:Jinhe OA AcceptGetFileNameAndPath.aspx SQL Injection Vulnerability
5. threat[29379]:Jinhe OA AcceptGetSourceFileName.aspx SQL Injection Vulnerability
6. threat[32518]:Summar Portal del Empleado SQL Injection Vulnerability(CVE-2025-40677)
7. threat[32519]:Jinhe OA AcceptGetFileNameEdit.aspx SQL Injection Vulnerability
8. threat[29380]:Oracle E-Business Suite Request Smuggling Vulnerability (CVE-2025-61882)
9. threat[42498]:Patchwork Badnews Backdoor Sample Communication
10. threat[42499]:Patchwork Badnews Backdoor Sample Upload Result
11. threat[29392]:pgAdmin Backend Command Execution Vulnerability(CVE-2023-5002)
12. threat[29382]:NestJS DevTools /inspector/graph/interact Command Execution Vulnerability(CVE-2025-54782)
13. threat[29384]:Laravel FileManager Remote Code Execution Vulnerability(CVE-2025-58440)
14. threat[29383]:Sitecore Experience ViewState Inscure Deserialization Vulnerability (CVE-2025-53690)
15. threat[29385]:Dataease H2 Data Source Remote Code Execution Vulnerability (CVE-2025-58748)
16. threat[29386]:Western Digital NAS php/noHDD.php Command Execution Vulnerability
17. threat[42500]:PhantomCore RAT Connect Request
18. threat[42501]:PhantomCore RAT Send Stolen Information
19. threat[29387]:Dataease DB2 Data Source LDAP SSRF Vulnerability (CVE-2025-58045)
20. threat[32521]:lollms-webui Arbitrary File Deletion Vulnerability (CVE-2024-9597)
21. threat[42502]:Confucius Group AnonDoor Backdoor C2 Communication
22. threat[42503]:Confucius Group Use wooperstealer Uploaded Stolen File
23. threat[32523]:InvokeAI Arbitrary File Read and Deletion Vulnerability(CVE-2025-6237)
24. threat[29388]:Flowise Arbitrary File Write Vulnerability (CVE-2025-61913)
25. threat[32522]:Jinhe OA DealXml.aspx XML External Entity Injection Vulnerability
26. threat[32520]:XWiki Path Traversal Vulnerability (CVE-2025-55747/CVE-2025-55748)
27. threat[42504]:BITTER ArtraDownloader C2 Communication_1
28. threat[29393]:pgAdmin4 Deserialization Code Execution Vulnerability(CVE-2024-2044)_2
29. threat[32524]:Flowise Server Request Forgery(SSRF) Vulnerability(CVE-2025-59527)
30. threat[42506]:BITTER WSCSPL Backdoor Upload System Infomation
31. threat[42507]:BITTER Delphi Backdoor C2 Communication
32. threat[29390]:Yonyou U8cloud pubsmsservlet Deserialisation Vulnerability
33. threat[29391]:Fumeng Cloud CRM ReportShow.aspx SQL Injection Vulnerability
34. threat[32525]:Hongfan iOffice PgcaUserLogin.aspx SQL Injection Vulnerability
35. threat[32526]:Fumeng Cloud CRM AjaxWriteMail.ashx SQL Injection Vulnerability
36. threat[32527]:Shanghai Puhua PowerPMS File.ashx SQL Injection Vulnerability
37. threat[32528]:Yonyou Changjietong CRM mailinactive.php SQL Injection Vulnerability
38. threat[32529]:Yonyou NC DocServlet Interface Arbitrary File Reading Vulnerability
39. threat[29389]:Evertz SVDN 3080ipx-10G Web Management Interface Arbitrary Command Injection and Authentication Bypass Vulnerabilities(CVE-2025-4009)
40. threat[42508]:BITTER CobaltStrike Backdoor C2 Communication
41. threat[42509]:BITTER MuuyDownloader Backdoor C2 Communication


update rules:

1. threat[49013]:Mining program connects mine pool server communication
2. threat[49014]:DNS domain name query for mining pool servers
3. threat[29325]:Flowise JS injection remote code execution Vulnerability(CVE-2025-55346/CVE-2025-59528)
4. threat[42067]:lockerBot Botnet Communication
5. threat[28989]:DataEase Redshift Data Source JDBC Arbitrary Command Execution Vulnerability (CVE-2025-48999)
6. threat[29100]:ZKHuiLian EasySite System Deserialization Vulnerability
7. threat[29136]:Dahua DSS Deserialization Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.42307. The new/improved rules of this upgrade package are:

new rules:

1. threat[29373]:Hikvision Integrated Security Management Platform applyCT RCE Vulnerability(CVE-2025-34067)
2. threat[32510]:lollms-webui Path Traversal Vulnerability(CVE-2024-6985)
3. threat[29374]:Tenda AC15 formSetDevNetName Buffer Overflow Vulnerability(CVE-2025-0566)
4. threat[32509]:Jinhe C6 Collaboration Management Platform SaveXmlAjax SQL Injection Vulnerability
5. threat[32511]:Jinhe OA DelTemp.aspx XML Entity Injection Vulnerability(CVE-2025-7523)
6. threat[32514]:Yinda Huizhi Intelligent Integrated Management Platform PPlugList Interface SQL Injection Vulnerability
7. threat[32512]:Jinhe OA ProjectScheduleDelete.aspx XML Entity Injection Vulnerability(CVE-2025-7823)
8. threat[32513]:Jinhe OA GetTreeDate.aspx SQL Injection Vulnerability(CVE-2025-9669)
9. threat[42494]:APT-C-09 Launched Remote Control Trojan Sample Based on Mythic C2_Online
10. threat[32515]:Yonyou U8+ Channel Management gettoken_new SQL Injection Vulnerability
11. threat[42495]:Patchwork BADNEWS Backdoor Communication
12. threat[42496]:Redcap Trojan Download Malicious Files
13. threat[42497]:sectopRAT Trojan Communication
14. threat[29375]:Unibox Router logout.php Command Execution Vulnerability
15. threat[29376]:Redis Lua use-after-free Vulnerability(CVE-2025-49844)


update rules:

1. threat[29336]:esm.sh Path Traversal Vulnerability (CVE-2025-59342)
2. threat[29370]:MCP Inspector Remote Code Execution Vulnerability (CVE-2025-49596)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.42281. The new/improved rules of this upgrade package are:

new rules:

1. threat[32497]:College Management System SQL Injection Vulnerability (CVE-2024-13025)
2. threat[29354]:Wordpress Superbackup Arbitrary File Upload Vulnerability (CVE-2024-56064)
3. threat[10618]:Vllm completions Denial of Service Vulnerability(CVE-2024-8939)
4. threat[29355]:KuaiPu M6 SeatManageService.asmx SQL Injection Vulnerability
5. threat[32498]:HongFan iOffice mrClearPwd.aspx SQL Injection Vulnerability
6. threat[29356]:Western Digital NAS safepoints_api.php Command Execution Vulnerability
7. threat[29358]:KuaiPu M6 wsAutoComplete.asmx SQL Injection Vulnerability
8. threat[29359]:HongFan iOffice HbcaUserLogin.aspx SQL Injection Vulnerability
9. threat[32499]:Esaiton Electronic Document Security Management System UploadFileManagerService Arbitrary File Read Vulnerabilities
10. threat[29361]:Jhsoft OA XXE Vulnerability in Jhsoft.Web.addmenu/LoginTemplate/XmlHttp.aspx
11. threat[32500]:Esaiton Electronic Document Security Management System SQL Injection Vulnerability(CVE-2024-10597)
12. threat[32501]:Esaiton Electronic Document Security Management System SQL Injection Vulnerability(CVE-2024-10596)
13. threat[29357]:Yonyou U8cloud NCCloudGatewayServlet Command Execution Vulnerability
14. threat[29360]:Western Digital NAS sendLogToSupport.php Command Execution Vulnerability
15. threat[32502]:Lingdang CRM SQL injection vulnerability (CVE-2025-8345)
16. threat[32503]:Wuyou Network Verification System getInfo Interface SQL Injection Vulnerability
17. threat[32505]:ESAFENET CDG File Reading Vulnerability(CVE-2024-10379)
18. threat[32504]:Jinher OA GetOtherFileName.aspx SQL Injection Vulnerability
19. threat[32506]:Jinher OA GetDictionary.aspx SQL Injection Vulnerability
20. threat[32507]:ESAFENET CDG SQL Injection Vulnerability(CVE-2025-3003)
21. threat[29362]:Western Digital NAS login_mgr.cgi Command Execution Vulnerability
22. threat[29363]:Byzoro Smart Management Platform layer_swich_conf.php Arbitrary File Deletion Vulnerability
23. threat[32508]:Jinhe OA AcceptShow.aspx SQL Injection Vulnerability
24. threat[29365]:Western Digital NAS usb_backup.php Command Execution Vulnerability
25. threat[29367]:Lingdang CRM uploadify.php Arbitrary File Upload Vulnerability
26. threat[29366]:Western Digital NAS recycle_bin.php Command Execution Vulnerability
27. threat[29364]:Western Digital NAS internal_backup.php Command Execution Vulnerability
28. threat[29368]:Invision Community Remote Code Execution Vulnerability (CVE-2025-47916)
29. threat[29369]:Western Digital NAS remoteBackups.php Command Execution Vulnerability
30. threat[29371]:Jinhe OA AcceptGetFileName.aspx SQL Injection Vulnerability
31. threat[29372]:Web Deploy Remote Code Execution Vulnerability(CVE-2025-53772)
32. threat[29370]:MCP Inspector Remote Code Execution Vulnerability (CVE-2025-49596)
33. threat[32492]:Citrix NetScaler ADC/Gateway Memory Leak Vulnerability (CVE-2025-5777)
34. threat[29335]:Adobe Commerce Security Bypass Vulnerability(CVE-2025-54236)
35. threat[29312]:Coacoapods Remote Code Execution Vulnerability (CVE-2024-38366)


update rules:

1. threat[41520]:Malicious File Downloader:Win32/Carbanak-20171016-2C0CFDC5B5653CB3E8B0F8EEEF55FC32 Network Communication
2. threat[49004]:Blackmoon Banking Trojan Communication
3. threat[41898]:APT-C-40 Suspicious Domain Access
4. threat[49026]:Malicious Program windows/Brushaloader_a Network Communications
5. threat[29336]:esm.sh Path Traversal Vulnerability (CVE-2025-59342)
6. threat[28344]:Yonyou NC cartabletimeline/doList SQL Injection Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.42198. The new/improved rules of this upgrade package are:

new rules:

1. threat[29325]:Flowise JS injection remote code execution Vulnerability(CVE-2025-55346)
2. threat[29326]:Sobe Media Convergence Platform /sobey-mchEditor/mch/jztEditorScore/queryEditorScoreRank SQL Injection Vulnerability
3. threat[32485]:Gradio Audio Component Arbitrary File Deletion Vulnerability(CVE-2024-10648)
4. threat[29327]:Pterodactyl Panel Arbitrary Code Injection Vulnerability (CVE-2025-49132)
5. threat[29329]:Fumeng Cloud CRM AjaxContractList.ashx SQL Injection Vulnerability
6. threat[29331]:Sobe Converged Media countJztArticle SQL Injection Vulnerability
7. threat[29328]:Sawtooth Lighthouse Studio Template Injection Vulnerability (CVE-2025-34300)
8. threat[29330]:Smanga rescan.php Remote Command Injection Vulnerability
9. threat[29332]:Sobe Converged Media countJztTWArticle SQL Injection Vulnerability
10. threat[29333]:Sobe Converged Media countJztMonthsDetailArticle SQL Injection Vulnerability
11. threat[29334]:Yonyou U8+ Channel Management imagedo File Upload Vulnerability
12. threat[32486]:Hongfan iOffice NetCAUserLogin.aspx SQL Injection Vulnerability
13. threat[32487]:Pichome Arbitrary File Read Vulnerability (CVE-2025-1743)
14. threat[32488]:Jinhe OA FileDelete.aspx SQL Injection Vulnerability
15. threat[32496]:ESAFENET Electronic Document Security Management System SQL Injection Vulnerability(CVE-2024-10612)
16. threat[32489]:Vanna generate_sql SQL Injection Vulnerability(CVE-2024-7764)
17. threat[29336]:esm.sh Path Traversal Vulnerability (CVE-2025-59342)
18. threat[29339]:Zimbra Collaboration CancelPendingAccountOnlyRemoteWipe SQL Injection Vulnerability(CVE-2025-25064)
19. threat[29337]:lollms-webui Remote Code Execution Vulnerability(CVE-2024-4267)
20. threat[29338]:Hirsch Enterphone MESH Hard-coded Vulnerability (CVE-2025-26793)
21. threat[32491]:Xinzhongxin Campus Card Management System ProductInfoJF SQL Injection Vulnerability
22. threat[29340]:Sitecore Experience Manager And Experience Platform Code Execution Vulnerability (CVE-2025-27218)
23. threat[29341]:Agentscope Code Execution Vulnerability (CVE-2024-48050)
24. threat[29353]:Wordpress Plugin Berqwp File Upload Vulnerability (CVE-2024-43160)
25. threat[29343]:H2O-3 JDBC Deserialisation Vulnerability(CVE-2025-6544)
26. threat[29342]:Fumeng Cloud CRM AjaxAttachment.ashx SQL Injection Vulnerability
27. threat[32493]:lollms-webui Path Traversal Vulnerability(CVE-2024-10019)
28. threat[29344]:Sobe Media Convergence /sobey-mchEditor/mch/Jzt/statistics/countJztArticleGroupByChannel2 SQL Injection Vulnerability
29. threat[10617]:Microsoft Windows Message Queuing Service SRMPEnvelopeHeader Buffer Over-Read Vulnerability(CVE-2025-21277)
30. threat[32494]:Metersphere SQL Injection Vulnerability (CVE-2021-45788)
31. threat[29347]:lollms-webui apply_settings Remote code executions Vulnerability(CVE-2024-4326)
32. threat[29345]:Western Digital NAS raid_cgi.php Command Execution Vulnerability
33. threat[29348]:Spring Cloud Gateway Information Disclosure Vulnerability (CVE-2025-41243)
34. threat[32495]:Leadsec ACM Internet Behavior Management System bottomframe.cgi SQL Injection Vulnerability
35. threat[29349]:Jinhe OA dailytaskmanage/XmlHttp.aspx XXE Vulnerability
36. threat[29350]:Wordpress Repairbuddy Arbitrary File Upload Vulnerability (CVE-2024-51793)
37. threat[29352]:Western Digital NAS elephant_drive.php Command Execution Vulnerability
38. threat[29351]:Fumeng Cloud CRM AjaxCoustomerShare.ashx SQL Injection Vulnerability


update rules:

1. threat[42149]:SSRF Pseudo-Protocol Attacks Exist In Suspected Request Parameters
2. threat[42462]:Discover Server-Side Request ForgeryBypass Attack Behavior
3. threat[28937]:langchain-experimental arbitrary code execution vulnerability (CVE-2024-21513)
4. threat[28474]:Linux Information Collection Command _Websocket



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.42119. The new/improved rules of this upgrade package are:

new rules:

1. threat[29298]:Wordpress Plugin Kognetiks Chatbot File Upload Vulnerability (CVE-2024-32700)
2. threat[32472]:Fumeng Cloud CRM upload.ashx deletefile SQL Injection Vulnerability
3. threat[29297]:FE Enterprise Operations Management Platform treeXml.jsp SQL Injection Vulnerability
4. threat[29299]:WordPress InstaWP-Connect Plugin Arbitrary File Upload Vulnerability (CVE-2024-2667)
5. threat[29300]:WordPress Widget Options Remote Code Execution Vulnerability
6. threat[32474]:Zoneminder V1.37 SQL Injection Vulnerability (CVE-2024-51482)
7. threat[29304]:JinheOA AddressImportPub.aspx XML External Entity Injection(XXE) Vulnerability
8. threat[29303]:Judge0 Symbolic Link Sandbox Escape Command Execution Vulnerability (CVE-2024-28185)
9. threat[32473]:Apache InLong Manager Arbitrary File Read Vulnerability (CVE-2023-51785)
10. threat[29301]:Loomio Operating System Command Injection Vulnerability (CVE-2024-1297)
11. threat[29302]:SparkShop Open-Source E-commerce System Arbitrary File Upload Vulnerability (CVE-2024-6730)
12. threat[29305]:WordPress AR for WooCommerce <= 6.2 Arbitrary File Upload Vulnerability
13. threat[32475]:Wordpress Plugin Woo Inquiry SQL Injection Vulnerability (CVE-2024-7854)
14. threat[29306]:WordPress Verbalize WP 1.0 Arbitrary File Upload Vulnerability(CVE-2024-49668)
15. threat[29307]:ShowDoc Arbitrary File Upload Vulnerability (CVE-2021-36440)
16. threat[29308]:WordPress AutoTranslate Plugin 1.0.4 Arbitrary File Upload Vulnerability (CVE-2024-50493)
17. threat[29309]:AgentScope workflow arbitrary file read/write vulnerability (CVE-2024-8551)
18. threat[32476]:AgentScope Stored Cross-Site Scripting Vulnerability(CVE-2024-8556)
19. threat[29311]:DSIS Multimedia Publishing System ST2-045 Remote Command Execution Vulnerability
20. threat[32482]:Beijing Supermap iServer output Arbitrary File Read Vulnerability
21. threat[29313]:Sifudi Bastion Machine Arbitrary User Login Vulnerability
22. threat[29314]:Geovision GV-ASWeb Code Injection Vulnerability(CVE-2025-26264)
23. threat[32477]:Ollama File Existence Disclosure Vulnerability(CVE-2024-39719)
24. threat[42493]:Remcos Remote Control Trojan HTTP Communication
25. threat[32478]:Ragflow upload Stored Cross-Site Scripting Vulnerability(CVE-2024-12870)
26. threat[29316]:Fortinet Products Exploit Buffer Overflow Vulnerability (CVE-2025-32756)
27. threat[29315]:Torrentpier 2.4.1 Remote Code Execution Vulnerability (CVE-2024-1651)
28. threat[29317]:Progress Software Openedge Authentication Gateway Authentication Bypass Vulnerability (CVE-2024-1403)
29. threat[32479]:ONLYOFFICE DocumentServer Directory Traversal Vulnerability (CVE-2021-25833)
30. threat[29318]:Ragflow pickle Deserialization Vulnerability(CVE-2024-12433)
31. threat[29319]:MingSoft MCMS /file/upload Arbitrary File Upload Vulnerability (CVE-2021-46386)
32. threat[29320]:Yonyou U8+ Channel Management filedo File Upload Vulnerability
33. threat[29321]:Sabnzbd Code Injection Vulnerability (CVE-2023-34237)
34. threat[32480]:Wanhu OA selectAmountField.jsp SQL injection vulnerability
35. threat[32481]:Wanhu OA DocumentHistory SQL injection vulnerability
36. threat[32483]:Flowise get-upload-file Arbitrary File Reading Vulnerability
37. threat[29322]:Yonyou U8 Cloud System VouchFormulaCopyAction SQL Injection Vulnerability
38. threat[29323]:Dassault Systèmes DELMIA Apriso Deserialization Vulnerability (CVE-2025-5086)
39. threat[32484]:Flowise openai-assistants-file arbitrary file read vulnerability




Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.42042. The new/improved rules of this upgrade package are:

new rules:

1. threat[29271]:MyJSRat Remote Control Tool Communication
2. threat[29272]:Shanghai Liruan Agile Development Framework Arbitrary File Upload Vulnerability
3. threat[32446]:Yonyou NC System WorkflowService Interface SQL Injection Vulnerability
4. threat[29273]:H2O-3 Deserialisation Vulnerability (CVE-2025-6507)
5. threat[29274]:Securenvoy MFA Two-Factor Authentication Vulnerability (CVE-2024-37393)
6. threat[32447]:Logsign Unified SecOps Authentication Bypass Vulnerability(CVE-2025-1044)
7. threat[32448]:RHUB Turbomeeting SQL Injection Vulnerability (CVE-2024-38289)
8. threat[32449]:Centreon Web manageVMetric SQL Injection Vulnerability(CVE-2024-55573)
9. threat[29275]:VIVOTEK Network Camera Arbitrary Code Execution Vulnerability (CVE-2024-26548)
10. threat[29276]:H3C GR-1800AX Remote Command Execution Vulnerability (CVE-2024-52765)
11. threat[10613]:Ollama Denial of Service (DoS) Vulnerability(CVE-2024-39721)
12. threat[32450]:Yisaitong Electronic Document Security Management System DownLoadMail Arbitrary File Reading Vulnerability
13. threat[29277]:Yisaitong Electronic Document Security Management System Remote Code Execution Vulnerability
14. threat[32451]:Ivanti Avalanche Authentication Bypass Vulnerability(CVE-2024-47009)
15. threat[32452]:Flowise Authentication Bypass Vulnerability(CVE-2024-31621)
16. threat[29278]:Yisaitong Electronic Document Security Management System Remote Code Execution Vulnerability(CNVD-2023-59457)
17. threat[29279]:Control Web Panel /admin/index.php Privilege Escalation & Command Injection Vulnerability
18. threat[32453]:WordPress The Events Manager Plugin Temporal SQL Injection Vulnerability (CVE-2025-6970)
19. threat[32454]:WordPress plugin Kubio AI Page Builder Path Traversal Vulnerability (CVE-2025-2294)
20. threat[32456]:AgentScope Path Traversal Vulnerability(CVE-2024-8438)
21. threat[29280]:Samsung MagicINFO 9 Server Security Vulnerability(CVE-2025-4632)
22. threat[32455]:Moodle LMS Jmol Plugin Security Vulnerability(CVE-2025-34031)
23. threat[29282]:Moodle LMS Jmol Plugin Cross-Site Scripting Vulnerability(CVE-2025-34032)
24. threat[32457]:AgentScope JSON File Reading Vulnerability(CVE-2024-8524)
25. threat[32458]:GeoTools SQL Injection Vulnerability(CVE-2023-25158)
26. threat[29283]:Trend Micro InterScan Web Security Virtual Appliance Security Vulnerability(CVE-2020-8606)
27. threat[32459]:Jason2605 AdminPanel SQL injection vulnerability(CVE-2020-13433)
28. threat[29284]:Lenovo LeadSec Security Gateway Default Password Login Vulnerability
29. threat[29285]:DedeCMS FileUpload Vulnerability(CVE-2023-43226)
30. threat[32460]:AgentScope delete-workflow Arbitrary File Deletion Vulnerability(CVE-2024-8537)
31. threat[29286]:TopSec AccessGateway Default Password Login Vulnerability(CNVD-2021-08407)
32. threat[29287]:Jianwen Engineering Project Management Software FileUploadNew.ashx Upload Vulnerability
33. threat[29281]:Yonyou U8cloud NCMERPServlet XXE Entity Injection Vulnerability
34. threat[32461]:Xiongmai Multi-Product Access Control Error Vulnerability (CVE-2024-3765)
35. threat[29289]:Bihaiwei L7 Cloud Router index.php Remote Command Execution Vulnerability
36. threat[32462]:Sobey Converged Media WXArticleInt/restore SQL Injection Vulnerability
37. threat[29288]:openBI code issue vulnerability(CVE-2024-1032)_2
38. threat[32463]:Yonyou NC mtapptimeline/doApply SQL Injection Vulnerability
39. threat[10614]:Tenda PA6 Buffer Overflow Vulnerability (CVE-2024-0535)
40. threat[29290]:Tenda W9 Out-of-Bounds Write Vulnerability(CVE-2024-0537)
41. threat[29291]:Tenda W9 Out-of-Bounds Write Vulnerability(CVE-2024-0538)
42. threat[29292]:Tenda W9 Out-of-Bounds Write Vulnerability(CVE-2024-0539)
43. threat[10616]:Tenda W9 Stack Buffer Overflow Vulnerability(CVE-2024-0540)
44. threat[32468]:Yonyou NC ActivityNotice/doSingUp SQL Injection Vulnerability
45. threat[29293]:Doccms Frontend Code Execution Vulnerability
46. threat[29294]:ServiceNow Glide Expression Injection Vulnerability (CVE-2024-5217)
47. threat[32464]:Kashipara Food Management System SQL Injection Vulnerability(CVE-2024-0287)
48. threat[32465]:Kashipara Food Management System SQL Injection Vulnerability(CVE-2024-0288)
49. threat[32466]:Kashipara Food Management System SQL Injection Vulnerability(CVE-2024-0289)
50. threat[32467]:Kashipara Food Management System SQL Injection Vulnerability(CVE-2024-0290)
51. threat[32469]:TurboMail /outImg Path-Based Arbitrary File Reading Vulnerability
52. threat[29295]:mySCADA myPRO Operating System Command Injection Vulnerability (CVE-2024-47407)
53. threat[32471]:Fumeng Cloud CRM upload.ashx SQL Injection Vulnerability
54. threat[29296]:Wordpress Plugin Datasets Manager Arbitrary File Upload Vulnerability (CVE-2024-52375)
55. threat[32431]:Zhuozheng Software PageOffice Arbitrary File Download Vulnerability


update rules:

1. threat[28457]:TOTOLINK setUploadSetting Command Injection Vulnerability(CVE-2024-0293/CVE-2024-1783)
2. threat[28485]:TOTOLINK X5000R delBlacklist Command Injection Vulnerability(CVE-2024-42737)
3. threat[28225]:Consul Rexec Component Remote Command Execution Vulnerability
4. threat[26752]:Struts2 Remote Code Execution Vulnerability(CVE-2023-50164)(S2-066)
5. threat[31903]:Mlflow dbfs Arbitrary File Read Vulnerability(CVE-2024-8859)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41934. The new/improved rules of this upgrade package are:

new rules:

1. threat[32427]:Zenitel AlphaWeb XE Arbitrary File Read Vulnerability (CVE-2024-57784)
2. threat[29248]:Dataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerability (CVE-2025-57773)
3. threat[29250]:CrushFTP Authentication Bypass Vulnerability(CVE-2025-54309)
4. threat[10611]:D-Link DAP-1320 Buffer Overflow Vulnerability (CVE-2025-1539)
5. threat[29249]:Yonyou NC testper.jsp and testperformance.jsp Remote Command Execution Vulnerability
6. threat[10612]:TOTOLINK X18 cstecgi.cgi setPasswordCfg Stack Overflow Vulnerability (CVE-2025-1340)
7. threat[29252]:Tenda W9 Out-Of-Bounds Write Vulnerability (CVE-2024-0536)
8. threat[32428]:Yonyou NCCloud ExportErrorAction Arbitrary File Reading Vulnerability
9. threat[29251]:Yonyou NC ImportExcelTemplate Arbitrary File Upload Vulnerability
10. threat[29253]:ZenML Arbitrary Password Reset Vulnerability (CVE-2024-25723)
11. threat[29254]:Zoho Corporation ManageEngine OpManager Arbitrary File Deletion Vulnerability (CVE-2021-20078)
12. threat[32429]:Admidio Member Management System ecard_send.php SQL Injection Vulnerability (CVE-2024-37906)
13. threat[29255]:Zhejiang University Entsoft Customer Resource Management System /entsoft/EmailMarketingAction.emrser SQL Injection Vulnerability
14. threat[32430]:Mingyuan Real Estate ERP PhoneHandler Interface SQL Injection Vulnerability
15. threat[29257]:WordPress The Novel Design Store Directory Plugin Arbitrary File Upload Vulnerability (CVE-2024-51788)
16. threat[10542]:SonicWALL SonicOS Buffer Error Vulnerability (CVE-2023-0656)
17. threat[29258]:Wanhu OA DocumentIframe.jsp SQL Injection Vulnerability
18. threat[29259]:WordPress Dropbox Dropins Plugin Arbitrary File Upload Vulnerability (CVE-2024-49607)
19. threat[29260]:Youkate Industrial Facial Love Cloud Payment System Permission Bypass Vulnerability (CVE-2023-6099)
20. threat[32432]:Apache Fineract SQL Injection Vulnerability (CVE-2024-23538)
21. threat[32433]:Apache Fineract SQL Injection Vulnerability (CVE-2024-23539)
22. threat[29256]:Kingdee Cloud Skyline CusShareService SQL Injection Vulnerability
23. threat[29261]:Yonyou Ufida putFile Arbitrary File Upload Vulnerability
24. threat[32434]:Wordpress Plugin Chatbot With Chatgpt Sensitive Information Leakage Vulnerability (CVE-2024-6846)
25. threat[29262]:XWiki Commons Velocity Escapetool Remote Code Execution Vulnerability (CVE-2024-31996)
26. threat[32435]:WordPress plugin Push Notification for Post and BuddyPress SQL Injection Vulnerability(CVE-2024-6159)
27. threat[32436]:Wordpress Plugin Truebooker SQL Injection Vulnerability (CVE-2024-6924)
28. threat[29263]:Camaleon CMS Arbitrary File Write Vulnerability(CVE-2024-46986)
29. threat[29264]:Wifi-soft UniBox Controller Arbitrary File Upload Vulnerability (CVE-2019-3495)
30. threat[32437]:VMware Cloud Foundation XML External Entity Injection Vulnerability (CVE-2022-31678)
31. threat[29265]:VMware vCenter Server Unauthorized Access Vulnerability (CVE-2021-22017)
32. threat[32445]:YonYou TurboCrm strresview SQL Injection Vulnerability
33. threat[29266]:D-Link DIR-610 Code Injection Vulnerability(CVE-2020-9377)
34. threat[32438]:ZoneMinder SQL Injection Vulnerability (CVE-2024-43360)
35. threat[32439]:Vicidial SQL Injection Vulnerability (CVE-2024-8503)
36. threat[32440]:Tongda OA /mysql/index.php Unauthorized Access Vulnerability
37. threat[32198]:Yonyou NC and NC Cloud Systems IBapIOService SQL Injection Vulnerability
38. threat[29267]:LLama Factory Remote Command Injection Vulnerability (CVE-2024-52803)
39. threat[32441]:JetBrains TeamCity Vault Connection Stored Cross-Site Scripting Vulnerability(CVE-2025-24459)
40. threat[29268]:VMware Workspace One Access and VMware Identity Manager SQL Injection Vulnerability (CVE-2022-31659)
41. threat[32442]:HPE Insight Remote Support XML External Entity Injection Vulnerability(CVE-2024-53674)
42. threat[29269]:Tongda OA AppCode/Index SQL Injection Vulnerability
43. threat[32443]:HPE Insight Remote Support XML External Entity Injection Vulnerability(CVE-2024-53675)
44. threat[42492]:ibombshell Post Penetration Test Tool Communication
45. threat[32444]:Ivanti Avalanche Authentication Bypass Vulnerability (CVE-2024-13181)
46. threat[29270]:NUUO Camera oemupload.php Remote Command Execution Vulnerability


update rules:

1. threat[27021]:Dataease Datasource JDBC File Read and Deserialization Vulnerability (CVE-2024-23328)
2. threat[10609]:Squid Proxy ESI Response Denial of Service Vulnerability(CVE-2024-45802)
3. threat[42134]:Bitter-SplinterRAT Malicious Communication
4. threat[28128]:Unix CUPS Printing Service Remote Code Execution Vulnerability (CVE-2024-47076/CVE-2024-47175/CVE-2024-47176/CVE-2024-47177)
5. threat[25746]:Linux Information Collection Command Execution (Request Parameters)
6. threat[32424]:Progress WhatsUp Gold SnmpExtendedActiveMonitor Directory Traversal Vulnerability(CVE-2024-12105)
7. threat[28533]:NI Instrumentstudio FLXPROJ File Parsing Deserialization Vulnerability (CVE-2024-4044)
8. threat[27349]:LiveBos crm ScriptVariable.jsp Remote Code Execution Vulnerability
9. threat[28159]:Nagios XI monitoringwizard.php SQL Injection Vulnerability(CVE-2024-24401)
10. threat[28683]:WordPress Plugin Elementor File Upload Vulnerability(CVE-2023-48777)
11. threat[42327]:Hancitor Malware C2 Communication
12. threat[42331]:Raccoon Stealer C2 Communication
13. threat[42370]:OceanLotus Uses Cobalt Strike MASK Encryption Communication
14. threat[42372]:AsyncRAT Loader Connection Request
15. threat[42461]:BlackNET Remote Control Trojan Receive Remote Control Instructions
16. threat[42460]:BlackNET Remote Control Trojan Obtain Remote Control Instructions
17. threat[30942]:Weaver E-Office9 Init.php File Inclusion Vulnerability
18. threat[42459]:BlackNET Remote Control Trojan Online
19. threat[42227]:BITTER Stealing Information Of Victimized Hosts
20. threat[32265]:Yonyou Zhishikai PLM-getWorkGroups Information Leakage Vulnerability
21. threat[28945]:Ivanti Endpoint Manager serverMotherboard LoadSlotsTable SQL Injection Vulnerability(CVE-2024-34783)
22. threat[32089]:SearchWP Live Ajax Search Unauthenticated Information Disclosure Vulnerability(CVE-2022-2535)
23. threat[29130]:Wave GS PurBidSupplementSrv.asmx Arbitrary File Read Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41814. The new/improved rules of this upgrade package are:

new rules:

1. threat[32419]:Microsoft Configuration Manager LocationMgr SQL Injection Vulnerability(CVE-2024-43468)
2. threat[10609]:Squid Proxy ESI Response Denial of Service Vulnerability(CVE-2024-45802)
3. threat[29240]:HPE Insight Remote Support Directory Traversal Vulnerability(CVE-2024-53676)
4. threat[32420]:Rockwell Automation ThinManager ThinServer.exe API Directory Traversal Vulnerability(CVE-2024-45826)
5. threat[32421]:Ivanti Endpoint Manager serverMemory loadModuleTable SQL Injection Vulnerability(CVE-2024-34779)
6. threat[29241]:Ruijie Networks RG-UAC Command Injection Vulnerability (CVE-2024-6187)
7. threat[42491]:SAP Multiple Products Request Smuggling Vulnerability (CVE-2022-22536)
8. threat[29242]:Jinher OA jc6 servlet/Upload Interface Arbitrary File Upload Vulnerability
9. threat[32422]:Jinhe OA UserWebControl.UserSelect.ashx Information Disclosure Vulnerability
10. threat[29243]:Telecom gateway configuration management backend ipping.php command execution vulnerability
11. threat[32423]:Sonicwall SMA100 Directory Traversal Vulnerability (CVE-2021-20034)
12. threat[29244]:SOPlanning Arbitrary File Upload Vulnerability (CVE-2024-27115)
13. threat[32424]:Progress WhatsUp Gold SnmpExtendedActiveMonitor Directory Traversal Vulnerability(CVE-2024-12105)
14. threat[29245]:SMTP Protocol Command Injection Behavior
15. threat[29246]:Docker Desktop Privilege Escalation Arbitrary Command Execution Vulnerability (CVE-2025-9074)
16. threat[32425]:LibreNMS Device Display Name Stored Cross-Site Scripting Vulnerability(CVE-2024-53457)
17. threat[29247]:Chando Project Management System /block-main.html SQL Injection Vulnerability
18. threat[32426]:Weave Arbitrary File Read Vulnerability (CVE-2024-7340)
19. threat[10610]:D-Link DAP-1320 API SET_WS_ACTION HEAP Buffer Overflow Vulnerability (CVE-2025-1538)


update rules:

1. threat[25808]:Apache Storm nimbus Remote Command Execution Vulnerability (CVE-2021-38294)
2. threat[32385]:Ivanti Endpoint Manager Serverasset SQL Injection Vulnerability (CVE-2024-13162/CVE-2024-32848)
3. threat[24696]:HomeAutomation v3.3.2 CSRF Remote Command Execution
4. threat[24793]:Centreon Poller Authorizes Remote Code Execution Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41735. The new/improved rules of this upgrade package are:

new rules:

1. threat[32408]:LibreNMS Cross-Site Scripting Vulnerability (CVE-2025-23199)
2. threat[32409]:MasaCMS Directory Traversal Vulnerability (CVE-2021-42183)
3. threat[29225]:JetBrains TeamCity Stored Cross-Site Scripting Vulnerability (CVE-2025-31140)
4. threat[29226]:Qdrant Arbitrary File Overwrite Vulnerability (CVE-2024-2221)
5. threat[32410]:Nagios XI historytab_content.php SQL Injection Vulnerability
6. threat[32411]:Ivanti Avalanche validateAMCWSConnection Server-Side Request Forgery Vulnerability(CVE-2024-47008)
7. threat[32412]:LibreNMS API Token Stored Cross-Site Scripting Vulnerability(CVE-2024-49754)
8. threat[29227]:Gogs Contents API Path Traversal Vulnerability(CVE-2024-55947)
9. threat[29228]:Ivanti Endpoint Manager Directory Traversal Vulnerability(CVE-2024-50324)_1
10. threat[29229]:Ivanti Endpoint Manager Directory Traversal Vulnerability(CVE-2024-50324)_2
11. threat[32413]:Ivanti Endpoint Manager EFile CreateFile Directory Traversal Vulnerability(CVE-2024-34787)
12. threat[32414]:Microsoft Windows MSHTML File Extension Spoofing Vulnerability(CVE-2024-43461)
13. threat[32415]:Palo Alto Networks Expedition deleteParquet.php Arbitrary File Deletion Vulnerability(CVE-2025-0105)
14. threat[29230]:Palo Alto Networks Expedition regionsDiscovery.php Insecure Deserialization Vulnerability(CVE-2025-0107)
15. threat[32416]:Mingyuan Real Estate ERP GetErpDept Interface SQL Injection Vulnerability
16. threat[29231]:Raisecom MSG1200/2100E/2300 Command Injection Vulnerability (CVE-2024-7120)
17. threat[32417]:Microsoft Windows Themes NTLM Relay Vulnerability(CVE-2025-21308)
18. threat[29232]:Fastjson Deserialization Vulnerability (BECL+Mybatis Exploitation Chain)
19. threat[32418]:Sobey Media sobey-mchEditor/tianma/op SQL injection Vulnerability
20. threat[29233]:Fortinet Fortisiem Command Injection Vulnerability (CVE-2025-25256)
21. threat[29234]:TamronOS IPTV system detects remote command execution vulnerability
22. threat[29235]:SkyBridge ping_exec.cgi Remote Command Execution Vulnerability
23. threat[29237]:Yonyou U8+ Channel Management (Advanced Edition) datacollectfile.jsp File Upload Vulnerability
24. threat[29238]:Ray Command Injection Vulnerability (CVE-2023-6019)
25. threat[29239]:Yonyou U8+ Channel Management (Advanced Edition) sendmail.jsp File Upload Vulnerability


update rules:

1. threat[32391]:LibreNMS Cross-Site Scripting Vulnerability (CVE-2025-23200)
2. threat[42303]:Glutton Trojan PHP Backdoor UDP Communication
3. threat[42326]:AllaKore RAT Communication
4. threat[42375]:sessionRAT Send Control Instruction
5. threat[42376]:DarkVision RAT C2 Communication
6. threat[42380]:SystemBC Trojan C2 Communication
7. threat[42381]:Chaos Backdoor TCP Traffic Signaling
8. threat[42464]:Remcos RAT C2 Communication
9. threat[42478]:RustyStealer Trojan C2 Communication
10. threat[42343]:Merlin Communication with the C2 servers



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41641. The new/improved rules of this upgrade package are:

new rules:

1. threat[29200]:Zbzcms Any File Upload Vulnerability (CVE-2022-27131)
2. threat[29201]:Upsonic add_tool pickle deserialisation Vulnerability(CVE-2025-6279)
3. threat[32385]:Ivanti Endpoint Manager Serverasset SQL Injection Vulnerability (CVE-2024-13162)
4. threat[32384]:BoYun PHPCMS check_date SQL Injection Vulnerability
5. threat[29203]:Pyspur jinja2 template remote code execution Vulnerability(CVE-2025-6518)
6. threat[29204]:Splunk Enterprise app.conf stored cross-site scripting vulnerability (CVE-2024-45741)
7. threat[29202]:EduSoho Tutorial System app_dev.php Any File Read Vulnerability
8. threat[32386]:OpenAgents file.py creates an upload file path traversal Vulnerability(CVE-2025-6282)
9. threat[32387]:1Panel Arbitrary File Download Vulnerability (CVE-2023-39965)
10. threat[32388]:JFinalCMS Directory Traversal Vulnerability (CVE-2023-41599)
11. threat[32389]:Sim Studio AI Arbitrary File Reading Vulnerability (CVE-2025-7107)
12. threat[32390]:Adobe ColdFusion Directory Traversal Vulnerability (CVE-2024-53961)
13. threat[32391]:LibreNMS Cross-Site Scripting Vulnerability (CVE-2025-23200)
14. threat[29206]:Jenkins script interface unauthorized command execution vulnerability
15. threat[32392]:Weaver OA E-cology /webservice/calendar/cale.wsdl.php SQL Injection Vulnerability
16. threat[32393]:Weaver OA E-cology /general/crm/record/detail.php SQL Injection Vulnerability
17. threat[29207]:Flyrise FE Business Collaboration Platform RemoteServlet Remote Command Execution Vulnerability
18. threat[32395]:Fuma AjaxSaas.ashx SQL Injection Vulnerability
19. threat[32396]:Fuma TfrmCustAnalysis.aspx SQL Injection Vulnerability
20. threat[29208]:Guangxun IPTV /network/net/login.php Remote Command Execution Vulnerability
21. threat[32397]:Huatiandongli OA /report/reportServlet Arbitrary File Read Vulnerability
22. threat[29210]:Sim Studio AI Arbitrary File Upload Vulnerability(CVE-2025-7114)
23. threat[29212]:Rowboat Unauthorized Arbitrary File Upload Vulnerability(CVE-2025-7115)
24. threat[32400]:Ivanti Endpoint Manager serverStorage buildCDRomTable SQL Injection Vulnerability(CVE-2024-50326)
25. threat[32398]:Hongjing HCM DisplayCustomerReportExcelFile Arbitrary File Reading Vulnerability
26. threat[32399]:Hongjing HCM /servlet/DisplayOleFile Arbitrary File Reading Vulnerability
27. threat[29209]:Hongjing e-HR Human Resource Management System /upload File Upload Vulnerability
28. threat[29211]:Hongjing e-HR Human Resource Management System /uploadFile File Upload Vulnerability
29. threat[29213]:WordPress Backup and Staging Plugin Arbitrary File Upload Vulnerability(CVE-2024-8856)
30. threat[29214]:Maipu MSG4000 Security Gateway aaa_local_web_custom_auth_html_submitRemote Command Execution Vulnerability
31. threat[29215]:Maipu MSG4000 Security Gateway aaa_local_web_custom_auth_submit Remote Command Execution Vulnerability
32. threat[42490]:Adobe ColdFusion DataSourceDef Security Feature Bypass Vulnerability (CVE-2025-43560)
33. threat[29216]:Jinhe OA SAP_B1Config Unauthorized Access Vulnerability
34. threat[32401]:Xata Agent Arbitrary File Read Vulnerability(CVE-2025-6283)
35. threat[29218]:Leagsoft IT Security Operations Management Software queryPolicyUseConditionDetail Deserialization Vulnerability
36. threat[29217]:NSFOCUS ADS File Command Execution Vulnerability
37. threat[29219]:Microsoft SharePoint Workflow AccessServicesListEventReceiver Insecure Deserialization Vulnerability(CVE-2024-43464)
38. threat[32402]:Ivanti Cloud Services Appliance removeCoreCertificate SQL Injection Vulnerability(CVE-2024-11773)
39. threat[32403]:Ivanti EPM Absolute Path Traversal Vulnerability (CVE-2024-13160)
40. threat[29221]:Progress LoadMaster Command Injection Vulnerability (CVE-2024-56131)
41. threat[29222]:Ivanti Endpoint Manager Directory Traversal Vulnerability (CVE-2024-50322)
42. threat[32404]:Ivanti Avalanche Path Traversal Vulnerability (CVE-2024-13180)
43. threat[29223]:WinRAR Directory Traversal Vulnerability (CVE-2025-8088)
44. threat[32406]:Python-a2a api.py create_workflow path traversal Vulnerability(CVE-2025-6167)
45. threat[32407]:Ivanti Avalanche Authentication Bypass Vulnerability (CVE-2024-13179)
46. threat[32405]:Zkteco BioTime Path Traversal Vulnerability(CVE-2023-38950)
47. threat[29224]:Cherry Studio Command Injection Vulnerability(CVE-2025-54074)


update rules:

1. threat[28548]:Ivanti Multi-Product Buffer Overflow Vulnerability (CVE-2025-0282)
2. threat[42140]:Godzilla JAVA_AES_BASE64 Webshell Connect_3
3. threat[63442]:HP SiteScope SOAP Performing Unauthorized Operations Bypass Security Restriction Vulnerability
4. threat[42146]:HTTP request parameters carry suspected command injection payloads
5. threat[25746]:Linux Information Collection Command Execution (Request Parameters)
6. threat[28471]:Beijing Digital China Cloud DCN Firewall customizable.php Command Execution Vulnerability(CVE-2024-51114)
7. threat[42110]:The DNS Request Or Response Domain Name Too Long
8. threat[24889]:Draytek Vigor Remote Code Execution Vulnerability (CVE-2020-8515)
9. threat[27904]:AntSword Webshell Management Tool Connection and Control_2
10. threat[30879]:Weaver E-mobile client SQL Injection Vulnerability(CNVD-2021-25287)
11. threat[27201]:Voltronic Power ViewPower Pro SQL Injection Vulnerability (CVE-2023-51586)
12. threat[24336]:JBoss Application Server EJBInvokerServlet/JMXInvokerServlet Remote Code Execution Vulnerability(CVE-2013-4810)
13. threat[27403]:Jorani Remote Command Execution Vulnerability(CVE-2023-26469)
14. threat[26909]:ivanti Policy Secure Command Injection Vulnerability (CVE-2024-21887)
15. threat[25739]:Linux Shell Reverse Command Execution
16. threat[25747]:Windows Information Collection Command Execution
17. threat[26068]:Dnscmd AD Domain Attack Command Execution
18. threat[24765]:Wordpress Plugin Search Meter 2.13.2 CSV injection vulnerability
19. threat[30981]:GDidees 3.9.1 Arbitrary File Read Vulnerability(CVE-2023-27179)
20. threat[28151]:Shenou Communication Online Recording Management System Thinkphp Remote Code Execution Vulnerability
21. threat[26111]:Nacos Raft Protocol Deserialization Vulnerability（CNVD-2023-45001）
22. threat[25727]:Linux/Windows Sample Download Command Execution
23. threat[26337]:Yonyou M1server deserialization command execution vulnerability
24. threat[28800]:Apache Camel Arbitrary Command Execution Vulnerability(CVE-2025-29891)
25. threat[28801]:Apache Camel Arbitrary Command Execution Vulnerability(CVE-2025-27636)
26. threat[32394]:Weaver E-Office10 qysw/index.php Sensitive Information Disclosure Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41503. The new/improved rules of this upgrade package are:

new rules:

1. threat[32369]:Cacti Group host_templates.php SQL Injection Vulnerability (CVE-2024-54146)
2. threat[32370]:Ivanti Endpoint Manager serverMotherboard LoadMotherboardTable SQL Injection Vulnerability(CVE-2024-34785)
3. threat[32371]:Ivanti Endpoint Manager MP_QueryDetail SQL Injection Vulnerability (CVE-2024-34781)
4. threat[10606]:Progress Loadmaster Buffer Overflow Vulnerability (CVE-2025-1758)
5. threat[32372]:WordPress Shortcodes Ultimate Plugin Cross-Site Scripting Vulnerability (CVE-2025-0370)
6. threat[29182]:WSO2 API Manager Directory Traversal Vulnerability (CVE-2024-7074)
7. threat[29181]:Weaver E-cology ProcessOverRequestByJson SQL Injection Vulnerability
8. threat[32373]:XWiki SQL Injection Vulnerability(CVE-2025-32429)
9. threat[29183]:Veeam Backup And Replication CProxyBinaryFormatter .NET Deserialization Vulnerability (CVE-2025-23120)
10. threat[29184]:Pandora FMS Remote Command Execution Vulnerability (CVE-2024-12971)
11. threat[32374]:Allegra Path Traversal Vulnerability (CVE-2025-3485)
12. threat[32375]:Cacti Poller Standard Error Log Arbitrary File Reading Vulnerability (CVE-2024-45598)
13. threat[29185]:Ivanti Endpoint Manager SQL Injection Vulnerability (CVE-2024-50330)
14. threat[32376]:Cacti Group Cacti links.php title Stored Cross-Site Scripting Vulnerability(CVE-2024-43364)
15. threat[29186]:Ivanti CSA users.php Command Injection Vulnerability (CVE-2024-47908)
16. threat[29187]:Qianhao Software bt_DYXZ SQL Injection Vulnerability
17. threat[29192]:1Panel agent remote command execution vulnerability(CVE-2025-54424)
18. threat[29193]:Webmin CGI xhr-get_autocompletes Command Injection Vulnerability (CVE-2024-12828)
19. threat[29188]:Superdata ERP Management System V.NET home_jsontest JDNI Injection Vulnerability
20. threat[29189]:Superdata ERP Management System V.NET voucherauditdo JDNI Injection Vulnerability
21. threat[29190]:Superdata ERP Management System V.NET doGetAccsetList JDNI Injection Vulnerability
22. threat[29191]:Superdata ERP Management System V.NET doSavePrintTpl JDNI Injection Vulnerability
23. threat[32377]:Superdata ERP Management System V.NET doSavePrintTpl SQL Injection Vulnerability
24. threat[29194]:Superdata ERP Management System V.NET DesignReportSave Arbitrary File Upload Vulnerability
25. threat[29196]:MingWan Industry Portal Website Building System SupplyList.aspx SQL Injection Vulnerability(CNVD-2024-15842)
26. threat[10607]:Ollama ggufPadding Function Denial of Service Vulnerability (CVE-2025-0317)
27. threat[29197]:LocalAI Command Injection Vulnerability (CVE-2024-2029)
28. threat[32379]:PublicCMS Information Disclosure Vulnerability (CVE-2022-29784)
29. threat[32378]:Openemr Bronchitis Cross-Site Scripting Vulnerability (CVE-2025-30161)
30. threat[29198]:Letta Platform (AI Agent Framework) Remote Code Execution Vulnerability(CVE-2025-51482)
31. threat[10608]:UTT Aitai Router Buffer Overflow Vulnerability
32. threat[32380]:OpenBMB Xagent Path Traversal Vulnerability(CVE-2025-6281)
33. threat[32381]:Upsonic upload path traversal vulnerability(CVE-2025-6278)
34. threat[29199]:TOTOLINK X2000R Command Injection Vulnerability(CVE-2024-0579)
35. threat[32382]:Deer-WMS System SQL Injection Vulnerability(CVE-2025-8127)
36. threat[32383]:MojoPortal Path Traversal Vulnerability(CVE-2025-28367)


update rules:

1. threat[30858]:Eyoucms Cross-site Script Injection Vulnerability (CVE-2021-39499)
2. threat[25933]:Clojure Deserialization Code Injection Vulnerabilities
3. threat[26199]:nginxWebUI runCmd Remote Command Execution Vulnerability (CVE-2024-3740)
4. threat[28293]:CyberPanel upgrademysqlstatus Remote Command Execution Vulnerability(CVE-2024-51568)
5. threat[28771]:CrushFTP Authentication Bypass Vulnerability (CVE-2025-2825)
6. threat[32376]:Cacti Group Cacti links.php title Stored Cross-Site Scripting Vulnerability(CVE-2024-43364)
7. threat[42462]:Discover Server-Side Request ForgeryBypass Attack Behavior



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41428. The new/improved rules of this upgrade package are:

new rules:

1. threat[32360]:ICEcoder Arbitrary File Read Vulnerability (CVE-2024-41373)
2. threat[29174]:Belkin Router /dev.cgi Path Remote Command Execution Vulnerability
3. threat[32361]:Esafenet error.log Sensitive Information Leakage Vulnerability
4. threat[32362]:Dongsheng Logistics Software WmsZXFeeGridSource.aspx SQL Injection Vulnerability
5. threat[32363]:DB-GPT import path traversal Vulnerability(CVE-2025-6772)
6. threat[32364]:lmxcms Directory Traversal Vulnerability (CVE-2023-23136)
7. threat[29176]:Flowise Authentication Bypass Vulnerability(CVE-2024-8181)
8. threat[29175]:ASUS Router Improper Authentication Vulnerability (CVE-2024-3080)
9. threat[29177]:Huaxia Innovation LotWan WAN Optimization System check_instance_state.php Remote Command Execution Vulnerability
10. threat[29178]:Huaxia Innovation LotWan WAN Optimization System static_arp.php Remote Command Execution Vulnerability
11. threat[29179]:Huaxia Innovation LotWan WAN Optimization System static_arp_del.php SQL Injection Vulnerability
12. threat[32365]:Langchain-chatchat upload_temp_docs Path Traversal Vulnerability(CVE-2025-6853)
13. threat[29180]:Ivanti Endpoint Manager SQL Injection Vulnerability (CVE-2024-32840)
14. threat[32367]:VMware HCX SQL Injection Vulnerability (CVE-2024-38814)
15. threat[32368]:Langchain-Chatchat /content path traversal Vulnerability(CVE-2025-6854)
16. threat[32366]:Progress Software Whatsup Gold SQL Injection Vulnerability (CVE-2024-46906)


update rules:

1. threat[28671]:Wazuh Security Monitoring Platform Deserialization Vulnerability (CVE-2025-24016)
2. threat[30931]:Weaver E-Cology FileDownloadForOutDoc SQL Injection Vulnerability(CVE-2023-3793)
3. threat[28885]:Weaver OA ReceiveTodoRequestByXml XML Entity Injection Vulnerability
4. threat[26793]:Weaver E-mobile lang2sql Interface Arbitrary File Upload Vulnerability
5. threat[30858]:Eyoucms Cross-site Script Injection Vulnerability (CVE-2021-39499)
6. threat[31395]:Weaver OA E-Cology getE9DevelopAllNameValue2 Arbitrary File Read Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41390. The new/improved rules of this upgrade package are:

new rules:

1. threat[32354]:Zhibang International ERP GetPrintTemplate.ashx SQL Injection Vulnerability
2. threat[32355]:Yonyou U8 Cloud System FilterCondAction SQL Injection Vulnerability
3. threat[29171]:Dahua DSS Comprehensive Management Platform bitMap_addLayer.action Arbitrary File Upload Vulnerability
4. threat[32353]:AstrBot Path Traversal Vulnerability(CVE-2025-48957)
5. threat[29172]:Dongsheng Logistics Softmng/Fileinputhandler/Upload Any File Upload Vulnerability
6. threat[32356]:Form Tools Arbitrary File Read Vulnerability (CVE-2024-6937)
7. threat[32357]:Dahua Video Conference Management System /download/NCFindWeb Arbitrary File Read Vulnerability
8. threat[32358]:Dongsheng Logistics Software WorkFlowGridSource.aspx SQL Injection Vulnerability
9. threat[32359]:Yonyou Spacetime KSOA Lookresult SQL Injection Vulnerability
10. threat[42489]:Dahua ICC Intelligent Internet Of Things Comprehensive Management Platform Password Reset Vulnerability
11. threat[29173]:Dahua ICC Intelligent Internet Of Things Comprehensive Management Platform File Upload Vulnerability


update rules:

1. threat[31510]:HTTP SQL Injection Attempt(Other)
2. threat[30806]:E-Cology getSqlData SQL Injection Vulnerability
3. threat[30875]:Weaver OA SyncUserInfo SQL Injection Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41361. The new/improved rules of this upgrade package are:

new rules:

1. threat[29170]:Yonyou U8cloud LoginVideoServlet Deserialisation Vulnerability
2. threat[32351]:Zhibang International ERP-CheckSealPwd.ashx SQL Injection Vulnerability




Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41355. The new/improved rules of this upgrade package are:

new rules:

1. threat[32352]:Yonyou U9 Smart Factory api/base/getFileStream Arbitrary File Read Vulnerability




Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41351. The new/improved rules of this upgrade package are:

new rules:

1. threat[32347]:Fuma Cloud CRM LicMould.ashx SQL Injection Vulnerability
2. threat[29167]:Hanvon EFaceGo monadFileUpload.do Arbitrary File Upload Vulnerability
3. threat[32348]:Apache Fineract Path Traversal Vulnerability (CVE-2022-44635)
4. threat[29168]:Dumb Drop Arbitrary File Overwrite Vulnerability (CVE-2025-24891)
5. threat[29169]:Kingdee Cloud Star DynamicFormService.CloseForm.common.kdsvc Deserialization Remote Code Execution Vulnerability
6. threat[32349]:Vinda CRM sendmailview.jsp SQL Injection Vulnerability
7. threat[32350]:Code-projects Online Hotel Booking registration.php SQL injection Vulnerability(CVE-2025-6917)


update rules:

1. threat[62178]:HTTP SQL Injection Attempt(System Command Execution)
2. threat[31971]:ActiveMQ Information Disclosure Vulnerability(CVE-2017-15709)
3. threat[32150]:HTTP SQL Injection Attempt (Sql Computation/Encoding)
4. threat[28697]:Weaver Operation And Maintenance Platform Arbitrary User Creation Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41330. The new/improved rules of this upgrade package are:

new rules:

1. threat[32336]:China Construction Quality Supervision System Multiple SQL Injection Vulnerabilities
2. threat[32337]:Jinher OA C6 ModuleTaskView.aspx SQL Injection Vulnerability
3. threat[29162]:Langgenius Dify Remote Code Execution Vulnerability(CVE-2025-3466)
4. threat[32338]:Hongfan IOffice Intelligent Office System MobileOA.asmx SQL Injection Vulnerability
5. threat[29163]:Code-Projects Car Rental System book_car.php SQL Injection Vulnerability(CVE-2025-6907)
6. threat[29164]:Microsoft SharePoint Server Remote Code Execution Vulnerability(CVE-2025-53770/CVE-2025-53771/CVE-2025-49704/CVE-2025-49706)
7. threat[32339]:Hongjing eHR searchCreatPlanList.dp SQL Injection Vulnerability(CNVD-2025-6953)
8. threat[32340]:Hanwang e-Face Management Platform Meeting Multiple SQL Injection Vulnerabilities
9. threat[32341]:Hanwang eFace Integrated Management Platform getFirstEmp.do SQL Injection Vulnerability
10. threat[32342]:Hanwang eFace Integrated Management Platform getValidPersonForFirst.do SQL Injection Vulnerability
11. threat[32343]:Hanwang e-Face Management Platform PermissionPersonController Multiple SQL Injection Vulnerabilities
12. threat[32345]:Yonyou NC getFormItem SQL Injection Vulnerability(CNVD-2025-06710)
13. threat[32344]:Fumeng Cloud CRM GetPic.aspx SQL Injection Vulnerability
14. threat[32346]:Fumeng Cloud CRM GetImage.aspx SQL Injection Vulnerability
15. threat[29166]:F5 BIG-IP Command Injection Vulnerability (CVE-2022-41800)


update rules:

1. threat[62201]:HTTP SQL Injection Attempt (Boolean blind injection)
2. threat[28019]:Westsoft Cloud XMS Foxlookupinvoker Deserialization Vulnerability
3. threat[32084]:JeecgBoot getTotalData Bypass Vulnerability(CVE-2024-57606)
4. threat[32312]:Xinhoo OA uploawAction.php SQL Injection Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41291. The new/improved rules of this upgrade package are:

new rules:

1. threat[32335]:Weaver E-Cology saveHomepageContent SQL Injection Vulnerability




Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41287. The new/improved rules of this upgrade package are:

new rules:

1. threat[32332]:Gfast operLog/list SQL Injection Vulnerability (CVE-2024-55160)
2. threat[29160]:Mailenable Failure.aspx Cross-Site Scripting Attack Vulnerability (CVE-2025-44148)
3. threat[29161]:Unibox Router pms_check.php Remote Command Execution Vulnerability(CVE-2025-6104)
4. threat[32333]:Magpie Medical GetMonitorList SQL Injection Vulnerability
5. threat[32334]:Weaver E-cology FormmodeFieldBrowserServlet SQL Injection Vulnerability


update rules:

1. threat[27519]:GeoServer Attribute Name Expression Foreground Code Execution Vulnerability(CVE-2024-36401/CVE-2024-36404)
2. threat[41534]:Web Page Contains Mining Script Code



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41269. The new/improved rules of this upgrade package are:

new rules:

1. threat[32331]:Oracle Peoplesoft Enterprise Peopletools Arbitrary File Reading Vulnerability (CVE-2023-22047)
2. threat[29157]:Dongsheng Logistics GetBANKList SQL Injection Vulnerability
3. threat[29158]:Sangfor OSM Login Portal RCE Vulnerability
4. threat[29156]:CentOS Web Panel Remote Code Execution Vulnerability (CVE-2025-48703)
5. threat[29159]:Windows SPNEGO Heap Buffer Overflow Vulnerability (CVE-2025-47981)


update rules:

1. threat[28509]:Microsoft .NET Framework TextFormattingRunProperties Deserialization Arbitrary Command Execution Vulnerability
2. threat[28687]:Microsoft .NET Framework ObjectDataProvider Deserialization Arbitrary Command Execution Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41253. The new/improved rules of this upgrade package are:

new rules:

1. threat[29153]:Wordpress Plugin Wpvivid Backup Migration Arbitrary File Upload Vulnerability (CVE-2025-5961)
2. threat[32330]:Dahua DSS Video Surveillance Platform Arbitrary File Read Vulnerability
3. threat[29155]:TOTOLINK A3002RU Buffer Overflow Vulnerability (CVE-2025-6939)


update rules:

1. threat[24250]:Drupal Core Remote Code Execution Vulnerability(CVE-2018-7600)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41246. The new/improved rules of this upgrade package are:

new rules:

1. threat[29149]:Palo Alto Networks PAN-OS Cross-Site Scripting Vulnerability (CVE-2025-0133)
2. threat[32329]:PWS Dashboard Arbitrary File Read Vulnerability
3. threat[29150]:Dongsheng Logistics GetBANKList SQL Injection Vulnerability
4. threat[29151]:Grafana XY Chart plugin DOM-based Cross Site Scripting Injection Vulnerability (CVE-2025-2703)
5. threat[29152]:Dahua Video Surveillance Platform Arbitrary File Upload Vulnerability


update rules:

1. threat[25632]:Zhongyuan Kylin iAudit Bastion Machine get_luser_by_sshport.php Remote Command Execution Vulnerability
2. threat[31342]:Apache Solr Sensitive Information Disclosure Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41232. The new/improved rules of this upgrade package are:

new rules:

1. threat[32328]:Nbeasy Online Customer Service System Arbitrary File Read Vulnerability
2. threat[29147]:Huatian Software InforCenter PLM /Base/BaseHandler.ashx File Upload Vulnerability
3. threat[29148]:ZKHuiLian AiSearch Arbitrary File Upload Vulnerability
4. threat[29123]:Redis HyperLogLog Out-of-Bounds Write Vulnerability (CVE-2025-32023)



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is an upgrade package for the intrusion Prevention feature library/application identification feature library, and only supports engine version V56R11F01 and above upgrades. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, while the rule version becomes 2.0.0.41224. The rules added/improved in this upgrade package are:



New rule:

Attack [32325]: SQL Injection vulnerability in Hanvon e-Face Pass Comprehensive Management Platform getValidEmpForGroup.do

2. Attack [29143]: SQL Injection Vulnerability of KSOA del_user in UFIDA Spacetime

3. Attack [32326]: SQL Injection vulnerability in queryAntisubmarineList.do of Hanvon e-Face Pass Comprehensive Management Platform

4. Attack [32327]: SQL Injection Vulnerability in GetIcon.aspx of Fumeng Cloud CRM

5. Attack [29144]: Jinhe OA IsHaveFTask.aspx XXE vulnerability

6. Attack [29145]: Jinhe OA AddTask.aspx XXE vulnerability

7. Attack [29146]: Remote Code Execution Vulnerability in Ningbo Yijian Online Customer Service System



Update rules

Attack [28698]: Microsoft.NET framework XamlAssemblyLoadFromFile deserialization arbitrary command execution vulnerability

Notes

This upgrade package will automatically restart and take effect after the upgrade, without causing session interruption. However, 3 to 5 ping packets will be lost. Please choose an appropriate time to upgrade.

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41207. The new/improved rules of this upgrade package are:

new rules:

1. threat[32316]:Hanwang eFace Integrated Management Platform queryMeetingFile.do SQL Injection Vulnerability
2. threat[29141]:Fortinet FortiWeb GUI SQL Injection Vulnerability(CVE-2025-25257)
3. threat[32317]:Jinhe OA AddTask.aspx SQL Injection Vulnerability
4. threat[32318]:Jinhe OA UploadFileEditor.aspx SQL Injection Vulnerability
5. threat[32319]:Jinhe OA IsHaveFTask.aspx SQL Injection Vulnerability
6. threat[32320]:Jinhe OA uploaddoc SQL Injection Vulnerability
7. threat[32321]:Ziguang Archive Management System Workflow/Download Arbitrary File Reading Vulnerability
8. threat[32322]:Meta CRM headimgsave SQL Injection Vulnerability
9. threat[32323]:Chatchat-Space Langchain-Chatchat Path Traversal Vulnerability (CVE-2025-6855)
10. threat[32324]:Yonyou U9 DynamaticExport Arbitrary File Read Vulnerability
11. threat[29142]:Yonyou U9 Cloud PDFDirectPrint Remote Code Execution Vulnerability


update rules:

1. threat[41976]:Discover AT remote delivery schedule task behavior
2. threat[28698]:Microsoft .NET Framework XamlAssemblyLoadFromFile Deserialization Arbitrary Command Execution Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41187. The new/improved rules of this upgrade package are:

new rules:

1. threat[32315]:YonYou KSOA del_catalog SQL Injection Vulnerability




Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41181. The new/improved rules of this upgrade package are:

new rules:

1. threat[32313]:Unibox Router controller/tools/download_csv.php File Read Vulnerability
2. threat[32314]:Jinher OA C6 TaskReportConfirm.aspx SQL Injection Vulnerability
3. threat[29138]:Akamai Cloudtest XML External Entity Injection Vulnerability (CVE-2025-49493)
4. threat[29140]:Lingdang CRM getLogInfo.php File Upload Vulnerability
5. threat[29139]:Zhongke Huilian AiSearch Login Bypass File Upload Vulnerability
6. threat[29137]:Wave GSP Enterprise Management Software AllotOrderSrv.asmx Remote Code Execution Vulnerability
7. threat[32312]:Xinhoo OA uploawAction.php SQL Injection Vulnerability


update rules:

1. threat[28674]:Microsoft .NET Framework ActivitySurrogateSelector Deserialization Arbitrary Command Execution Vulnerability
2. threat[32303]:Jinher OA C6 TaskTreeJSON SQL Injection Vulnerability
3. threat[31684]:WestSoft Cloud XMS futurehotel/query or futurehotel/operate XML Entity Injection Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41164. The new/improved rules of this upgrade package are:

new rules:

1. threat[29133]:AISHU Anyshare Intelligent Content Management Platform Start_Service Remote Command Execution Vulnerability
2. threat[32309]:Lizheng Enterprise Comprehensive Management System Lzmis SQL Injection Vulnerability
3. threat[29134]:Dahua DSS Frontend SSRF Vulnerability
4. threat[32310]:Weide Intellectual Property Management System Case.Ashx Arbitrary File Reading Vulnerability
5. threat[32311]:Yonyou U8 Cloud FileManageServlet Arbitrary File Read Vulnerability
6. threat[29136]:Dahua DSS Deserialization Vulnerability


update rules:

1. threat[26879]:Wanhu OA fileUpload.controller Arbitrary File Upload Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41142. The new/improved rules of this upgrade package are:

new rules:

1. threat[29132]:Weaver E-Cology Frontend SQL Injection Vulnerability




Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41136. The new/improved rules of this upgrade package are:

new rules:

1. threat[32302]:Bianque Medical GetLyfsByParams SQL Injection Vulnerability
2. threat[32304]:Yonyou NC-Cloud IBapIOService SQL Injection Vulnerability
3. threat[32305]:EPRO OA /Smarttradescan/Stocktake/Getposition SQL Injection Vulnerabilities
4. threat[32306]:Huatian Power OA8000 downloadfortrace.jsp Arbitrary File Reading Vulnerability
5. threat[32307]:Baiyi Cloud Asset Management System imaRead.make.php SQL Injection Vulnerability
6. threat[29129]:Yonyou FE Collaboration Platform uploadFile.jsp File Upload Vulnerability
7. threat[32308]:Webone Workforce And Attendance Management Suite DownloadFile.aspx Arbitrary File Reading Vulnerability
8. threat[29131]:Sobey Fusion Media mchEditor Arbitrary File Upload Vulnerability
9. threat[29130]:Wave GS PurBidSupplementSrv.asmx Arbitrary File Read Vulnerability


update rules:

1. threat[63249]:HTTP /etc/passwd Access Attempt



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41117. The new/improved rules of this upgrade package are:

new rules:

1. threat[32289]:Hanwang eFace Integrated Management Platform getGroupEmployee.do SQL Injection Vulnerability
2. threat[32290]:Hanwang eFace Integrated Management Platform meetingFileManage.do SQL Injection Vulnerability
3. threat[32291]:Hanwang eFace Integrated Management Platform getDoors.do SQL Injection Vulnerability
4. threat[32296]:RuoYi sendMessageWithAttachment Arbitrary File Read Vulnerability
5. threat[32297]:UniBox Router update_byod.php SQL Injection Vulnerability
6. threat[29119]:Unibox Router authentication/test_userlogin.php Command Execution Vulnerability
7. threat[32293]:Hanwang eFace Integrated Management Platform queryAlarmEvent.do SQL Injection Vulnerability
8. threat[32294]:Hanwang eFace Integrated Management Platform fileDownload.do Arbitrary File Read Vulnerability
9. threat[32295]:Hanwang eFace Integrated Management Platform imgDownload.do Arbitrary File Read Vulnerability
10. threat[32298]:Yonyou NC changeEvent SQL Injection Vulnerability
11. threat[32299]:Yonyou NC qrySubPurchaseOrgByParentPk SQL Injection Vulnerability
12. threat[32300]:Hanwang eFace Integrated Management Platform queryDoorInfoList.do SQL Injection Vulnerability
13. threat[29125]:Hanwang Eface Integrated Management Platform addVisitDeviceAppointmentInfoTest.do fastjson Deserialization RCE Vulnerability
14. threat[32301]:Hanwang eFace Integrated Management Platform wxLogin.do Unauthorized Access To Sensitive Information Leaks Vulnerability
15. threat[29126]:Sangfor Operation And Maintenance Security Management System /fort/system;login/netConfig/set_port Command Execution Vulnerability
16. threat[29127]:Beijing CA Electronic Seal Signing System Code Execution Vulnerability
17. threat[32303]:Jinher OA C6 TaskTreeJSON SQL Injection Vulnerability
18. threat[29124]:Wave GSP srbbdefineservice.asmx Remote Code Execution Vulnerability


update rules:


1. threat[28937]:langchain-experimental arbitrary code execution vulnerability (CVE-2024-21513)
2. threat[28726]:Cacti Remote Code Execution Vulnerability (CVE-2024-25641)


Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41085. The new/improved rules of this upgrade package are:

new rules:

1. threat[29116]:Nsclient ExternalScriptsAPI Remote Code Execution Vulnerability (CVE-2025-34079)
2. threat[32286]:Hanwang eFace Integrated Management Platform queryBlackList.do SQL Injection Vulnerability
3. threat[32287]:Yonyou /portal/pt/oacoSchedulerEvents/listUserSharingEvents SQL Injection Vulnerabilities
4. threat[29122]:Weaver E-Cology remarkOperate Remote Code Execution Vulnerability
5. threat[29117]:Salia PLCC nwcheckexec.php Command Execution Vulnerability
6. threat[29120]:Dongsheng Logistics/Commmng/Print/Uploadmailfile File Upload Vulnerability
7. threat[32288]:Chanjet T+ GLSyncService.asmx SQL Injection Vulnerability
8. threat[29121]:YonYou KSOA workslist SQL Injection Vulnerability





Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41061. The new/improved rules of this upgrade package are:

new rules:

1. threat[32285]:Wecom E-Cology Remarkoperate SQL Injection Vulnerability




Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41057. The new/improved rules of this upgrade package are:

new rules:

1. threat[32284]:Chanjet tplus AccountclearController SQL Injection Vulnerability
2. threat[29114]:FineReport print/ie/pdf Code Execution Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41050. The new/improved rules of this upgrade package are:

new rules:

1. threat[29108]:Wordpress get_album_item.php Code Execution Vulnerability
2. threat[29115]:Dahua Intelligent Internet Of Things Integrated Management Platform (ICC) Command Execution Vulnerability




Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is an upgrade package for the intrusion Prevention feature library/application identification feature library, and only supports engine version V56R11F01 and above upgrades. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, while the rule version becomes 2.0.0.41044. The rules added/improved in this upgrade package are:



New rule:

Attack [29110]: Arbitrary file upload vulnerability in MetaCRM customer relationship management system sendfile.jsp

2. Attack [29113]: Arbitrary file upload vulnerability in MetaCRM customer relationship management system sendsms.jsp

3. The attack [32283] : hanwang queryManyPeopleGroupList e face through integrated management platform. The do SQL injection vulnerabilities

4. Attack [29112]: Kingdee EAS autoLogin Remote Code Execution Vulnerability

Measure 5. Attack [32281] : China/Web/SysManage sysGroupEdit monitoring and early warning system. The aspx SQL injection vulnerabilities

6. Attack [32282]: SQL Injection Vulnerability in Acrel Intelligent Environmental Protection Cloud Platform /getmonitorreadata

7. Attack [32280]: Wan Hu ezOFFICE govdocumentmanager_judge_receivenum.jsp SQL Injection Vulnerability



Update rules

1. Attack [29095]: SQL injection vulnerability in wech E-Cology9 getdata.jsp

2. Attack [60245]:HTTP SQL Injection Attempt Type Eight

Notes

This upgrade package will automatically restart and take effect after the upgrade, without causing session interruption. However, 3 to 5 ping packets will be lost. Please choose an appropriate time to upgrade.

This upgrade package is an upgrade package for the intrusion Prevention feature library/application identification feature library, and only supports engine version V56R11F01 and above upgrades. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, while the rule version becomes 2.0.0.41029. The rules added/improved in this upgrade package are:



New rule:

Attack [29102]: SQL Injection Vulnerability in WorkFlowAction of Yisaitong Electronic Document Security Management System

2. Attack [29103]:Apache NiFi Command Injection Vulnerability (CVE-2023-34468)

3. Attack [29105]:Apache HTTP Server Request Smuggling Vulnerability (CVE-2023-25690)

4. Attack [29104]:Gogs Remote Command Execution Vulnerability (CVE-2024-56731)

5. Attack [29106]:Wing FTP Server Remote Code Execution Vulnerability (CVE-2025-47812)

6. Attack [29107]:WordPress Plugin Duplicator 1.2.32XSS Injection vulnerability

7. Attack [32279]:XORCOM PLOTEPEPBX Arbitrary File Reading Vulnerability (CVE-2025-2292)

8. Attack [29109]: Remote command execution Vulnerability of pdfverifier in the electronic signature system of Contract Lock



Update rules

Attack [29100]: EasySite system deserialization vulnerability of Zhongke Huilian

2. Attack [27898]: Vulnerability in remote code execution of JDBC in wecom OA

3. Attack [41708]: Hosts within the AD domain enumerate and query user information within the domain

This upgrade package is the intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.41009. The new/improved rules of this upgrade package are:

new rules:

1. threat[29098]:Cisco ISE API Unauthenticated Remote Code Execution Vulnerability(CVE-2025-20281)
2. threat[29099]:Bozai Micromarketing Website Frontend File Upload Vulnerability
3. threat[29100]:ZKHuiLian EasySite System Deserialization Vulnerability


update rules:

1. threat[29024]:Qiyuesuo Electronic Signature System dbtest Remote Code Execution Vulnerability



Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is an upgrade package for Zealot 2.0 Intrusion Prevention Signature Database and Application Identification Signature Database, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version changes to 2.0.0.40993. The new/improved rules for this upgrade pack are:

New rules:
1. Attack [29092]: Microsoft Windows SMB Client Elevation of Privilege Vulnerability (CVE-2025-33073)
2. Attack [29093]: Nagios XI command injection vulnerability
3. Attack [29094]:D ataease JDBC connection parameters Remote command execution vulnerability (CVE-2025-53004/CVE-2025-53005)
4. Attack [29095]: MICRO E-Cology9 getdata.jsp SQL injection vulnerability

Notes:
1. After the upgrade package is upgraded, the engine will automatically restart and take effect, which will not cause session interruption, but 3~5 ping packets will be lost, please select the appropriate time to upgrade.

This upgrade package is the Zealot 2.0 intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.40983. The new/improved rules of this upgrade package are:

new rules:
1. threat[29081]:Qingdao Xinyang Chinese Library Information System index_hotsc.jsp SQL Injection Vulnerability
2. threat[29083]:QNAP Q'center Virtual Appliance Command Execution Vulnerability(CVE-2018-0707)
3. threat[32269]:WordPress Madara Local File Inclusion Vulnerability(CVE-2025-4524)
4. threat[32268]:NetMizer Log Management System Terminal SQL Injection Vulnerability
5. threat[32267]:Gift Card Electronic Voucher Collection System parent_id Front Desk SQL Injection Vulnerability
6. threat[29084]:Jinhe OA-C6 System Interface ActionDataSet XXE Vulnerability (CNVD-2023-04620)
7. threat[32266]:sscms Arbitrary File Read Vulnerability(CVE-2025-45529)
8. threat[29082]:Geoserver GeoTools XXE Vulnerability(CVE-2025-30220)
9. threat[32270]:Supabase Query Interface SQL Injection Vulnerability
10. threat[32271]:Ancai Software General Reimbursement System GetXMLList Arbitrary File Download Vulnerability
11. threat[29087]:BlueLine OA SSRF Any File Write Vulnerability
12. threat[29085]:Yonyou U8 Cloud NCPortalServlet XXE Vulnerability
13. threat[29086]:BentoML runner Server Remote Code Execution Vulnerability(CVE-2025-32375)
14. threat[32273]:Fujian StrongSoft Disaster Warning System AjaxSingleGetReferenceFieldValue SQL Injection Vulnerabilities
15. threat[32272]:Veeam Backup & Replication Information Disclosure Vulnerability (CVE-2023-27532)
16. threat[29088]:VMware vRealize Network Insight Command Injection Vulnerability (CVE-2022-31702)
17. threat[32274]:Fujian StrongSoft Disaster Warning System /Duty/write/FileType.aspx SQL Injection Vulnerabilities
18. threat[32275]:Ancai Software General Reimbursement System GetFileContent Arbitrary File Download Vulnerability
19. threat[32276]:QNAP Q'center Virtual Appliance Sensitive Information Disclosure Vulnerability (CVE-2018-0706)
20. threat[29089]:Panabit libres_syn_delete Command Execution Vulnerability
21. threat[32277]:FeiFeiCMS hits-show SQL Injection Vulnerability
22. threat[29090]:Dedecms referer Template Injection Vulnerability
23. threat[10605]:Jenkins Core json-lib Denial of Service Vulnerability(CVE-2024-47855)
24. threat[29091]:Hasura GraphQL Engine Remote Command Execution Vulnerability
25. threat[32278]:Hsort Newspaper And Periodical Management System SQL Injection Vulnerability

update rules:
1. threat[25714]:WordPress Content Injection Vulnerability(CVE-2017-5487)
2. threat[25785]:Gitlist 0.6.0 Remote Code Execution Vulnerability(CVE-2018-1000533)
3. threat[42462]:Discover Server-Side Request ForgeryBypass Attack Behavior
4. threat[31724]:Ivanti Cloud Services Appliance Path Vulnerability(CVE-2024-8963)
5. threat[10604]:XML Parameter Entity Bloat Leads to Dos
6. threat[24302]:Suspicious XML External Entity(XXE) Injection Attempt
7. threat[32260]:ArcGIS Geographic Information System manager Arbitrary File Read Vulnerability
8. threat[32136]:SimpleHelp Directory Traversal Vulnerability (CVE-2024-57727)
9. threat[26873]:Dahua Smart Park Integrated Management Platform poi Arbitrary File Upload Vulnerability

Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the Zealot 2.0 intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.40939. The new/improved rules of this upgrade package are:

new rules:
1. threat[29049]:Avaya Aura Device Services Arbitrary File Upload Vulnerability
2. threat[29050]:Axis2 services Cat exec cmd Parameter Arbitrary Command Execution vulnerability
3. threat[29052]:Haitian OA content_1.asp SQL Injection Vulnerability
4. threat[32234]:53 Customer Service System new_client.php company_id SQL Injection Vulnerability
5. threat[29051]:Hongzhi Real Estate Management System checklogin.asp SQL Injection Vulnerability
6. threat[32235]:74CMS wap-company-show.php SQL Injection Vulnerability
7. threat[32236]:China Construction Quality Supervision System Querydefinelist.aspx SQL Injection Vulnerability
8. threat[29053]:CellinxNVT Camera UAC.cgi Arbitrary User Creation Vulnerability
9. threat[42485]:Shanku Tunnel Proxy Communication
10. threat[29054]:lollms-webui delete_discussion SQL Injection Vulnerability(CVE-2024-1601)
11. threat[29055]:D-Link Central WiFiManager Conn.php SQL Injection Vulnerability
12. threat[32237]:Zabbix chart_bar.php SQL Injection Vulnerability
13. threat[42486]:Beijing Zixin Daily Communication Digital Periodical System getpassdo.jsp SQL Injection Vulnerability
14. threat[29056]:SaltStack SaltAPI Template Injection Vulnerability(CVE-2021-25283)
15. threat[32239]:Ivanti CSA SQL Injection Vulnerability (CVE-2024-9379)
16. threat[29057]:Rockoa Admin Login rock.php SQL Injection Vulnerability
17. threat[32238]:DamiCMS index SQL Injection vulnerability
18. threat[32240]:Dianyi PS Website Building System index.php SQL Injection Vulnerability
19. threat[32241]:Duomicms x3.0 ajax.php SQL Injection Vulnerability (CNVD-2018-05568)
20. threat[29058]:Anything-llm Workspace SQL Injection Vulnerability(CVE-2023-4899)
21. threat[32242]:Huatian Power OA hrApplicationFormService SQL Injection Vulnerability
22. threat[32243]:Shandong University Luneng Education Cloud Public Service Platform System SQL Injection Vulnerability
23. threat[29059]:EyouCms get_tag_memberlist Remote Code Execution Vulnerability
24. threat[32244]:Kexin Kxmail Email System SQL Injection Vulnerability
25. threat[29061]:Tongda OA get_index_data Interface SQL Injection Vulnerability
26. threat[29060]:Anything-llm system SQL injection vulnerability(CVE-2023-4898)
27. threat[32246]:JetBrains TeamCity Directory Traversal Vulnerability (CVE-2024-47949)
28. threat[32248]:Progress Software WhatsUp Gold Information Disclosure Vulnerability (CVE-2024-5010)
29. threat[29062]:Tongda OA edit Interface SQL Injection Vulnerability
30. threat[32249]:Bang Resto v1.0 Verification SQL Injection Vulnerability(CVE-2022-46443)
31. threat[32250]:WordPress Documentor plugin SQL injection vulnerability(CVE-2022-0773)
32. threat[32251]:WordPress Limit Login Attempts (Spam Protection) plugin SQL Injection Vulnerability(CVE-2022-0787)
33. threat[32252]:Terraboard 2.2.0 SQL Injection Vulnerability(CVE-2022-1883)
34. threat[32253]:WordPress Personal Dictionary 1.3.4 SQL Injection Vulnerability(CVE-2022-1013)
35. threat[32254]:WordPress Youzify Plugin SQL Injection Vulnerability(CVE-2022-1950)
36. threat[32255]:Weiwei Technology-Water Information Management Platform ChangePwd SQL Injection Vulnerability (CNVD-2024-14945)
37. threat[32245]:Yongyou U8 cloud CTExecDraftAction SQL Injection Vulnerability
38. threat[29063]:ConnectWise Control Code Issue Vulnerability(CVE-2019-16514)
39. threat[32247]:Landray EIS Intelligent Collaboration Platform service.aspx SQL Injection Vulnerability
40. threat[32256]:Lianbang Government Affairs System list.aspx SQL Injection Vulnerability
41. threat[29065]:Flash Flood Monitoring and Early Warning System SQL Injection Vulnerability
42. threat[29066]:PaperCut NG Authorization Issue Vulnerability(CVE-2023-4568)
43. threat[32257]:Tianwen Property ERP System LitigationDownLoad Arbitrary File Reading Vulnerability
44. threat[32258]:Nanjing University Star Information Release System Search Interface SQL Injection Vulnerability
45. threat[29067]:omeka-s add Arbitrary File Upload Vulnerability(CVE-2023-4159)
46. threat[42487]:freefrp Internal Network Penetration Tool Communication
47. threat[32259]:Topsec Load Balancing System Bindipmac SQL Injection Vulnerability
48. threat[29064]:JetBrains TeamCity Cross-Site Scripting Vulnerability (CVE-2025-46618)
49. threat[29068]:Pimcore SQL Injection Vulnerability(CVE-2023-3673)
50. threat[29069]:Flash Flood Monitoring and Early Warning System UploadHandler Arbitrary File Upload Vulnerability
51. threat[29070]:NodeBB API Access Token uid Stored Cross-Site Script Injection Vulnerability (CVE-2025-29513)
52. threat[32261]:Yishang Es-Cloud Login SQL Injection Vulnerability
53. threat[32260]:ArcGIS Geographic Information System manager Arbitrary File Read Vulnerability
54. threat[29072]:Webkul QloApps Cross-Site Scripting Vulnerability(CVE-2023-30256)
55. threat[29073]:WordPress Active Products Tables for WooCommerce Cross-Site Scripting Injection Vulnerability(CVE-2022-1916)
56. threat[29074]:WordPress FlatPM Cross-Site Scripting Injection Vulnerability(CVE-2022-3934)
57. threat[29071]:WordPress Companion Sitemap Generator 4.5.3 Cross-site Scripting Vulnerability(CVE-2023-1780)
58. threat[32262]:DedeCMS Directory Traversal Vulnerability (CVE-2023-2059)
59. threat[29075]:Electronic Data Management System ImageUpload.ashx File Upload Vulnerability
60. threat[29076]:Renwoxing CRM AnnexUploadHandler.ashx File Upload Vulnerability
61. threat[29077]:WordPress Welcart e-Commerce Arbitrary File Access Vulnerability(CVE-2022-4140)
62. threat[32263]:DVDFab 12 Player_PlayerFab Local File Inclusion Vulnerability(CVE-2022-25216)
63. threat[32264]:elFinder Local File Inclusion Vulnerability(CVE-2022-26960)
64. threat[32265]:Yonyou Zhishikai PLM-getWorkGroups Information Leakage Vulnerability
65. threat[42488]:cpolar Internal Network Penetration Tool Communication
66. threat[29078]:Shopnc Mall System index.php SQL Injection Vulnerability
67. threat[29079]:Wordpress Creative Eminds CM Downloads Manager Plugin Code Injection Vulnerability (CVE-2014-8877)
68. threat[29080]:Tongtianxing CMSV6 Vehicle Video Surveillance Platform SESSION Forgery Vulnerability
69. threat[31724]:Ivanti Cloud Services Appliance Path Vulnerability(CVE-2024-8963)
70. threat[29021]:WordPress_Visualizer plugin cross-site scripting vulnerability(CVE-2019-16931)
71. threat[29027]:SeaCMS v13.3 admin_files.php Remote Code Execution Vulnerability(CVE-2025-25813)

update rules:
1. threat[29021]:WordPress_Visualizer plugin cross-site scripting vulnerability(CVE-2019-16931)
2. threat[29027]:SeaCMS v13.3 admin_files.php Remote Code Execution Vulnerability(CVE-2025-25813)
3. threat[42211]:Windows/Linux system Shell reverse connection (TCP_2)
4. threat[24530]:Jira Unauthorized Server Template Injection Remote Code Execution Vulnerability (CVE-2019-11581)
5. threat[41613]:Malicious Program windows/storm.a_a Network Communications
6. threat[62201]:HTTP SQL Injection Attempt Type two
7. threat[26269]:Citrix ADC And Citrix Gateway Remote Code Execution Vulnerability(CVE-2023-3519)
8. threat[67112]:Novell ZENworks Asset Management 7.5 Configuration Access Vulnerability (CVE-2012-4933)
9. threat[42454]:Suspected HTTP Requests Exists XSS Injection Common Event Function
10. threat[42484]:Suspected HTTP Requests Exists XSS Script Injection tag
11. threat[28783]:Zoho ManageEngine SAML Arbitrary Code Execution Vulnerability (CVE-2022-47966)
12. threat[24585]:D-Link Routers Unauthorized Remote Command Execution Vulnerability(CVE-2019-16920)
13. threat[27500]:Ruijie Unified Internet Behavior Management And Audit System static_convert.php Front-end Remote Code Execution Vulnerability
14. threat[41923]:Behinder Memory Shell Communication
15. threat[60464]:HTTP Directory Traversal Vulnerability
16. threat[28649]:Landray OA admin.do JNDI Injection Vulnerability
17. threat[25450]:GitLab Remote Command Execution Vulnerability(CVE-2021-22205)
18. threat[26977]:Apache Solr Backup/Restore APIs Remote Command Execution Vulnerability (CVE-2023-50386)
19. threat[26514]:VMware Aria Operations for Logs Deserialization Vulnerability (CVE-2023-20864)
20. threat[27147]:Primeton EOS Platform eos.jmx Remote Code Execution Vulnerability
21. threat[26708]:Fortinet FortiNAC RCE Vulnerability (CVE-2022-39952)
22. threat[26745]:multiple Sapido routers remote command execution vulnerability (CVE-2021-4242)
23. threat[27743]:Bang Yong PM2 Project Management System ExcelIn.aspx Arbitrary File Upload Vulnerability
24. threat[31706]:WordPress Essential Blocks Plugin Local File Inclusion Vulnerability(CVE-2023-6623)
25. threat[30928]:Jira plugin STAGIL Navigation directory traversal vulnerability (CVE-2023-26255/CVE-2023-26256)
26. threat[25489]:Apache httpd mod_proxy Unix Socket Server-Side Request Forgery Vulnerability (CVE-2021-40438)
27. threat[28383]:Zhang Guanjia saveUser.htm Arbitrary User Creation Vulnerability
28. threat[23402]:Wordpress plugin Simple Ads Manager SQL Injection Vulnerability(CVE-2015-2824)
29. threat[32135]:Maple Wireless Management System exportConfigByHttp Information Disclosure Vulnerability

Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the Zealot 2.0 intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.40792. The new/improved rules of this upgrade package are:

new rules:
1. threat[29023]:New Cloud CMS Any File Upload Vulnerability
2. threat[32212]:ZenTao Project Management System Information Disclosure Vulnerability (CVE-2022-37700)
3. threat[32213]:LYNX Twonky Server Directory Traversal Vulnerability (CVE-2018-7171)
4. threat[29025]:YonYou UFIDA NC Unauthorized Access Vulnerability
5. threat[32192]:Intelligence Platform SExcelExpErr.ashx SQL Injection Vulnerability
6. threat[32214]:Yonyou NC loadDoc.ajax Interface Arbitrary File Reading Vulnerability
7. threat[32215]:Apache Kafka Arbitrary File Read Vulnerability (CVE-2025-27817)
8. threat[29024]:Qiyuesuo Electronic Signature System dbtest Remote Code Execution Vulnerability
9. threat[29026]:Zhengfang Academic Affairs System BMCheckPassword SQL Injection Vulnerability
10. threat[32216]:Layer5 Meshery SQL Injection Vulnerability(CVE-2021-31856)
11. threat[29029]:Nordex Control 2 Wind Farm Portal Application Cross-Site Scripting Vulnerability(CVE-2015-6477)
12. threat[29028]:Palo Alto Networks PAN-OS Cross-Site Scripting Vulnerability(CVE-2018-10141)
13. threat[29047]:Fortinet Multi-Product Front-End Remote Code Execution Vulnerability (CVE-2024-45324)
14. threat[29030]:DedeCMS_article_string_mix.php_Operating System Command Injection Vulnerability(CVE-2024-9076)
15. threat[32217]:DataCube admin/setting_schedule.php SQL Injection Vulnerability
16. threat[29031]:Apache Batik Remote Code Execution Vulnerability(CVE-2022-40146)
17. threat[29032]:AlCoda NetBiblio WebOpac Cross-Site Scripting Vulnerability(CVE-2021-42551)
18. threat[29033]:Adiscon LogAnalyzer Cross-Site Scripting Vulnerability(CVE-2018-19877)
19. threat[29035]:Grafana_Cross-site Scripting Vulnerability(CVE-2020-11110)
20. threat[29034]:Renzi Network Security Audit System nmc_sync.php Command Execution Vulnerability
21. threat[29036]:BIBLIOsoft BIBLIOpac Cross-Site Scripting Vulnerability(CVE-2018-16139)
22. threat[29037]:SIS Informatik SIS SIS-REWE Go Cross-site Scripting Vulnerability(CVE-2021-31537)
23. threat[29038]:Gravitl Netmaker Trust Management Issue Vulnerability(CVE-2023-32077)
24. threat[32218]:Adlisting Classified Ads 2.14.0 Information Disclosure Vulnerability(CVE-2023-4168)
25. threat[32219]:WordPress Plugin Duplicator Unauthenticated Sensitive Data Leakage Vulnerability(CVE-2023-6114)
26. threat[32220]:Intelbras Switch Information Disclosure Vulnerability(CVE-2023-36144)
27. threat[32221]:WordPress Sensei LMS Information Disclosure Vulnerability(CVE-2022-2034)
28. threat[32222]:Ruin Wavlink Gigabit wireless wifi repeater Cross-Site Scripting vulnerability(CVE-2022-30489)
29. threat[29039]:Tianrongxin Security Gateway change_lan.php Remote Command Execution Vulnerability
30. threat[29040]:Zhengfang Academic Affairs System ResultXml_common.aspx SQL Injection Vulnerability
31. threat[29043]:Lunary-ai SQL Injection Vulnerability(CVE-2024-7456)
32. threat[29042]:Ivanti Endpoint Manager SQL Injection Vulnerability (CVE-2024-32845)
33. threat[29044]:QNAP Systems Multiple Products Path Traversal Vulnerability (CVE-2023-51364)
34. threat[29046]:DWSurvey Remote Code Execution Vulnerability(CVE-2021-39383)
35. threat[29045]:Adobe ColdFusion Deserialization Vulnerability(CVE-2019-7091)
36. threat[29048]:Tianrongxin Firewall TOS NGFW4000 maincgi.cgi Command Execution Vulnerability
37. threat[32223]:ASUS DSL-N14U-B1 Cross-site scripting vulnerability (CVE-2022-32988)
38. threat[32224]:Apache Tomcat hello.jsp Cross-Site Scripting Attack Vulnerability
39. threat[42484]:Suspected HTTP Requests Exists XSS Script Injection tag
40. threat[32225]:Lunary-ai SAML metadata Cross-site Scripting(XSS) Vulnerability(CVE-2024-5478)
41. threat[32226]:ESAFENET Electronic Document Security Management System SQL Injection Vulnerability (CVE-2024-10376)
42. threat[32227]:ESAFENET Electronic Document Security Management System SQL Injection Vulnerability(CVE-2024-10659)
43. threat[32228]:ESAFENET Electronic Document Security Management System SQL Injection Vulnerability(CVE-2024-10500)
44. threat[32229]:ESAFENET Electronic Document Security Management System SQL Injection Vulnerability(CVE-2024-10611)
45. threat[32230]:ESAFENET Electronic Document Security Management System SQL Injection Vulnerability(CVE-2024-10278)
46. threat[32231]:ESAFENET Electronic Document Security Management System SQL Injection Vulnerability(CVE-2024-10277)
47. threat[32232]:Crocus Crocus System DeviceState.do SQL Injection Vulnerability
48. threat[32233]:3C Environmental Automatic Monitoring System ReadLog File Reading Vulnerability
49. threat[32208]:Yonyou U8 Cloud MARosterPhotoServle SQL Injection Vulnerability

update rules:
1. threat[31929]:Apache DolphinScheduler Arbitrary File Read Vulnerability(CVE-2024-30188)
2. threat[62201]:HTTP SQL Injection Attempt Type two
3. threat[60245]:HTTP SQL Injection Attempt Type Eight
4. threat[26112]:HTTP SQL Time Blind Injection Attempt
5. threat[63682]:HTTP SQL Injection Attempt Type Three
6. threat[62178]:HTTP SQL Injection Attempt Type Four
7. threat[31121]:HTTP SQL Injection Attempt (Database Fingerprinting Detection)
8. threat[32150]:HTTP SQL Injection Attempt (Sql Computation/Encoding)
9. threat[32151]:HTTP SQL Injection Attempt (Database Change Operation)
10. threat[31510]:HTTP SQL Injection Attempt Type Nine
11. threat[28904]:Erlang/OTP SSH Remote Code Execution Vulnerability(CVE-2025-32433)
12. threat[31179]:Zhejiang Yushi Technology Network Video Recorder main-cgi File Information Leakage Vulnerability
13. threat[25196]:XStream Deserializable Remote Code Execution Vulnerability(CVE-2021-21347)
14. threat[28932]:MQTT Unauthorized Vulnerability
15. threat[31009]:PaperCut NG Access Control Error Vulnerability (CVE-2023-27350)
16. threat[31296]:Oracle E-Business Suite Sensitive Information Leak (CVE-2022-21500)
17. threat[28510]:Craft CMS Remote Code Execution Vulnerability(CVE-2024-56145)
18. threat[49013]:Mining program connects mine pool server communication
19. threat[23970]:NETGEAR Management System NMS300 Arbitrary File Upload Vulnerability
20. threat[28753]:Apache Tika Tika-Server Command Injection Vulnerability (CVE-2018-1335)_2
21. threat[32139]:LyLme Spage SQL Injection Vulnerability (CVE-2023-45951)
22. threat[42454]:Suspected HTTP Requests Exists XSS Injection Common Event Function
23. threat[27846]:Flyrise FE Enterprise Operation Management Platform publicData.jsp SQL Injection Vulnerability
24. threat[31409]:WanHu ezeip productlist.aspx SQL Injection Vulnerability
25. threat[26318]:Huatian Power OA Collaborative Office System ntkoupload.jsp Arbitrary File Upload Vulnerability(CNVD-2022-54886)
26. threat[30785]:D-Link DCS-2530L/DCS-2670L Information Disclosure Vulnerability(CVE-2020-25078)

Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the Zealot 2.0 intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.40704. The new/improved rules of this upgrade package are:

new rules:
1. threat[28984]:DB-GPT resource Directory Traversal File Upload Vulnerability(CVE-2024-10831)
2. threat[42482]:Silver Fox Downloads 64-Bit Payload
3. threat[28985]:Roundcube Webmail Deserialization Vulnerability (CVE-2025-49113)
4. threat[32185]:Lunary-ai dangerlySetInnerHTML Stored Cross-Site Scripting Vulnerability(CVE-2025-4779)
5. threat[28983]:QNAP HBS 3 Hybrid Backup Sync Command Injection Vulnerability(CVE-2024-50388)
6. threat[28986]:Netentsec NS-ASG Security Gateway getsysdatetime.php Command Injection Vulnerability
7. threat[28987]:DataEase H2 Database Remote Code Execution Vulnerability (CVE-2025-49002)
8. threat[28989]:DataEase Redshift Data Source JDBC Arbitrary Command Execution Vulnerability (CVE-2025-48999)
9. threat[28992]:Open Automation Software OAS Platform REST API Unauthenticated Vulnerability(CVE-2022-26833)
10. threat[32187]:OpenCart Divido Plugin SQL Injection Vulnerabilit (CVE-2018-11231)
11. threat[32186]:Seacms V13.3 admin_reslib.php SQL injection vulnerability(CVE-2025-25517)
12. threat[28991]:Zhejiang Shenda Intelligent Technology Company Management Platform Server File Upload Vulnerability
13. threat[28990]:DB-GPT spaces Directory Traversal Arbitrary File Write Vulnerability(CVE-2024-10834)
14. threat[28995]:DataEase JWT Arbitrary Forgery Vulnerability (CVE-2025-49001)
15. threat[32188]:DB-GPT delete Path Traversal Vulnerability(CVE-2024-10830)
16. threat[28993]:GraphQL Deep Query Attack
17. threat[42483]:Silver Fox XOR+Zlib Encrypted Communication Behavior
18. threat[32189]:Appspace Server-Side Request Forgery Vulnerability (CVE-2021-27670)
19. threat[28994]:Zhixiang OA System uploaddisk.aspx File Upload Vulnerability
20. threat[28997]:Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2024-52961)
21. threat[28999]:Shengdai Information Ticketmaster Ticket Management System Default.aspx SQL Injection Vulnerability
22. threat[29000]:Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2024-27778)
23. threat[28998]:Fortinet FortiWeb Command Injection Vulnerability (CVE-2024-50567)
24. threat[32190]:Fortinet Multiple Products Directory Traversal Vulnerability (CVE-2024-48884)
25. threat[29022]:TOTOLINK downloadFile.cgi Command Injection Vulnerability(CVE-2024-57036)
26. threat[29005]:Renzixing Network Audit System web_cgi Arbitrary Command Execution Vulnerability
27. threat[28996]:Meteobridge Command Execution Vulnerability(CVE-2025-4008)
28. threat[29007]:Fortinet FortiSandbox Stored Cross-Site Script Injection Vulnerability (CVE-2024-27781)
29. threat[29008]:Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2024-54018)
30. threat[29009]:YonYou NC rpc Arbitrary File Write Vulnerability
31. threat[29011]:YonYou NC nc.itf.sdp.web.autotest.IAutoTestWebService SQL Injection Vulnerability
32. threat[29010]:llama.cpp ggml_type_size Buffer Overflow Vulnerability(CVE-2024-42477)
33. threat[32191]:SuiteCRM Unauthenticated GraphQL Check Vulnerability(CVE-2023-47643)
34. threat[29021]:WordPress_Visualizer plugin cross-site scripting vulnerability(CVE-2019-16931)
35. threat[32193]:llama.cpp rpc_server::get_tensor Arbitrary address read Vulnerability(CVE-2024-42478)
36. threat[32194]:Yonyou U8Cloud QuerySoapServlet SQL Injection Vulnerability
37. threat[29012]:Tsinghua UF3500N Firewall Version 2.70 admin_login.cgi Command Execution Vulnerability
38. threat[29013]:YonYou GRP login.jsp SQL Injection Vulnerability
39. threat[29016]:Yicaitong E-procurement System SQL Injection Vulnerability
40. threat[29014]:Web2py URL Open Redirect Vulnerability(CVE-2023-22432)
41. threat[29015]:LiveZilla_Server_Cross-Site Scripting Vulnerability(CVE-2019-12962)
42. threat[29017]:Bitrix24 Web Application Firewall Cross-Site Scripting Vulnerability(CVE-2020-13483)
43. threat[32195]:LibreNMS Cross-Site Scripting Injection Vulnerability (CVE-2024-47525)
44. threat[32196]:Zoho ManageEngine Multiple Products SQL Injection Vulnerability (CVE-2024-6748)
45. threat[32197]:Yonyou NC System Image Management Image Upload ImageUpload SQL Injection Vulnerability
46. threat[32199]:Yonyou NC/NCC File Server Configuration Management FsConsoleService SQL Injection Vulnerability
47. threat[32200]:Yonyou NC rmImage/download SQL Injection Vulnerability
48. threat[32201]:Yonyou NC portalpage/doNew SQL Injection Vulnerability
49. threat[32202]:Yonyou NC deleteOftenMenu SQL Injection Vulnerability
50. threat[32203]:Yonyou NC M0dUlE/redeploy SQL Injection Vulnerability
51. threat[32204]:Yonyou NC oauidesigner/getMdPropertyJsony SQL Injection Vulnerability
52. threat[32205]:Wanhu OA ajax_checkUserNum.jsp SQL Injection Vulnerability
53. threat[32207]:Huatian Power OA 8000 version renameService SQL Injection Vulnerability
54. threat[32206]:ShiKong Zhiyou Enterprise Process Control System indexService.notice SQL Injection Vulnerability
55. threat[29018]:Qiguanbao Project Management System UploadSplittedFile.aspx Arbitrary File Upload Vulnerability
56. threat[29019]:Qi'anxin SecGate3600 firewall obj_area_import_save arbitrary file upload Vulnerability
57. threat[32210]:YourPHPCMS System login_checkEmail SQL Injection Vulnerability
58. threat[32209]:YourPHPCMS System Register_checkEmail SQL Injection Vulnerability
59. threat[29020]:ZZCMS Cross-Site Scripting Vulnerability(CVE-2020-20285)
60. threat[32211]:XWiki Information Vulnerability (CVE-2023-48241)

update rules:
1. threat[41544]:Trojan/Backdoor General JSP trojan Files Upload
2. threat[25475]:Apache Log4j2 Remote Code Execution Vulnerability(CVE-2021-44228/CVE-2021-45046)
3. threat[42234]:Suspicious Webshell Script File Upload Behavior _2
4. threat[26301]:Kingdee Cloud Star BinaryFormatter Deserialization Vulnerability
5. threat[32099]:WordPress Sitemap by click5 Unauthorized Vulnerability(CVE-2022-0952)
6. threat[25449]:XXL-JOB (REST API) Unauthorized Remote Code Execution Vulnerability
7. threat[27802]:Yonyou Changjietong-TPlus System ajaxpro Interface SSRF Vulnerability
8. threat[28525]:Dahua Intelligent IOT Integrated Management Platform GetClassValue.jsp Remote Code Execution Vulnerability
9. threat[27310]:Apache OFBiz Deserialization Code Execution Vulnerability (CVE-2021-30128)
10. threat[25129]:Apache Unomi Remote Code Execution Vulnerability(CVE-2020-13942)
11. threat[28648]:Chamilo LMS Remote Command Execution Vulnerability (CVE-2023-3368)
12. threat[25396]:JBoss Application Server JMXInvokerServlet Deserialization Vulnerability(CVE-2015-7501)
13. threat[25450]:GitLab Remote Command Execution Vulnerability(CVE-2021-22205)
14. threat[28195]:Grafana Expression Remote Code Execution Vulnerability(CVE-2024-9264)
15. threat[32060]:HashiCorp Consul/Consul Enterprise Server-Side Request Forgery Vulnerability (CVE-2022-29153)
16. threat[28777]:HashiCorp Consul Service API Remote Command Execution Vulnerability
17. threat[24743]:Netis WF2419 V1.2.31805/V2.2.36123 Authorized Command Injection Vulnerability (CVE-2019-19356)
18. threat[27026]:JetBrains TeamCity authentication bypass Vulnerability(CVE-2024-27198)
19. threat[26348]:KubePi LoginLogsSearch Unauthorized Access Vulnerability (CVE-2023-22478)
20. threat[28770]:RAGFlow add_llm Remote code execution Vulnerability(CVE-2024-10131)
21. threat[26117]:TP-LINK Archer/TL-WR840N Remote Code Execution Vulnerability (CVE-2022-25064)
22. threat[23533]:TRS WCM services Arbitrary File Upload Vulnerability
23. threat[24432]:Nexus Repository Manager 3 Remote Command Execution Vulnerability(CVE-2019-7238)
24. threat[25123]:XStream Server-Side Request Forgery(SSRF) Vulnerability(CVE-2020-26258)
25. threat[26049]:XStream Deserialization Server Request Forgery Vulnerability (CVE-2021-21342)
26. threat[26046]:XStream Deserialization Server Request Forgery Vulnerability (CVE-2021-21349)
27. threat[25299]:XStream Deserializable Remote Code Execution Vulnerability(CVE-2021-29505)
28. threat[25122]:XStream Arbitrary File Deletion Vulnerability (CVE-2020-26259)
29. threat[26047]:XStream Deserialization File Deletion Vulnerability (CVE-2021-21343)
30. threat[26018]:XStream Deserialization Remote Code Execution Vulnerability (CVE-2021-39145)
31. threat[26024]:XStream Deserialization Remote Code Execution Vulnerability (CVE-2021-39148)
32. threat[26225]:XStream Deserialization Code Execution Vulnerability (CVE-2021-39151)
33. threat[28879]:NoSQL Injection Attack
34. threat[27402]:Suspected HTTP request exists Java FreeMarker template injection
35. threat[26277]:Seeyon OA sursenServlet Remote Command Execution Vulnerability
36. threat[23991]:Fastjson Remote Code Execution Vulnerability
37. threat[31934]:Ruige Intelligent Psychological Service Platform Npreensmslist.Asmx SQL Injection Vulnerability
38. threat[28327]:Suobei Fusion Media Sc-TaskMonitoring/rest/task/search SQL Injection Vulnerability
39. threat[27427]:Yonyou U9 PatchFile.asmx Arbitrary File Upload Vulnerability
40. threat[28745]:OneBlog Blog Shiro Deserializes Remote Command Execution Vulnerability
41. threat[42086]:Silver Fox XOR+ Subtraction Encrypted Communication
42. threat[42454]:Suspected HTTP Requests Exists XSS Injection Common Event Function
43. threat[62178]:HTTP SQL Injection Attempt Type Four
44. threat[62201]:HTTP SQL Injection Attempt Type two
45. threat[30883]:YonYou TurboCrm SQL Injection Vulnerability (CVE-2021-41746)
46. threat[25924]:JDK 8u20 Deserialization Code Injection Vulnerability
47. threat[25105]:Apache SkyWalking GraphQL Protocol SQL Injection Vulnerability(CVE-2020-9483)
48. threat[32088]:Wordpress Autoptimize Information Disclosure Vulnerability(CVE-2022-4057)
49. threat[32019]:Fastjson 1.2.73 - 1.2.80 Arbitrary File Read Vulnerability
50. threat[28391]:Ivanti EPMM Authorization Issue Vulnerability (CVE-2023-35082)
51. threat[28847]:modoboa Email Management Platform Improper Authorization Vulnerability (CVE-2023-2227)
52. threat[32193]:llama.cpp rpc_server get_tensor Arbitrary address read Vulnerability(CVE-2024-42478)
53. threat[28222]:Yonyou U8-Cloud uapbd.refdef.query SQL Injection Vulnerability
54. threat[31770]:Yunlian POS-ERP Management System ZksrService SQL Injection Vulnerability
55. threat[27168]:Yonyou NC Cloud and YonBIP PMCloudDriveProjectStateServlet JNDI Injection Vulnerability
56. threat[31999]:Weaver E-office runimgflow.php SQL Injection Vulnerability
57. threat[31654]:Haixin Smart Bus Enterprise Management System AdjustWorkHours.aspx SQL Injection Vulnerability
58. threat[28287]:Parade Fortress sslvpnservice.php SQL Injection Vulnerability
59. threat[28752]:QAnything delete_files SQL Injection Vulnerability(CVE-2024-7099)
60. threat[28288]:Anker Medical Emergency Office Management System Service.asmx SQL Injection Vulnerability
61. threat[27299]:Byzoro Smart management platform uploadfile.php file upload vulnerability(CVE-2024-0939/CVE-2023-6576)
62. threat[27910]:Weaver E-Cology 10 testConnByBasePassword Remote Code Execution Vulnerability(CNVD-2024-36084)
63. threat[26782]:Weaver e-office OA sms_page.php Interface SQL Injection Vulnerability
64. threat[26784]:Weaver e-office OA flow_xml.php SQL Injection Vulnerability
65. threat[28823]:NoSQL Injection Attack Behavior

Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the Zealot 2.0 intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.40577. The new/improved rules of this upgrade package are:

new rules:
1. threat[32177]:Rebuild Server-Side Request Forgery Vulnerability (CVE-2024-1021)
2. threat[28963]:Llama_Index default_jsonalyzer prompt injection leads to SQL Injection Vulnerability(CVE-2024-12911)
3. threat[42476]:rport Tunnel Communication Behavior
4. threat[10603]:Transformers Regular expression Denial of Service Vulnerability(CVE-2025-1194)
5. threat[32178]:OpenEMR Cross-Site Scripting Injection Vulnerability (CVE-2022-2733)
6. threat[42478]:RustyStealer Trojan C2 Communication
7. threat[42477]:Dnscapy Tunnel Communication Behavior
8. threat[42479]:ClipBanker Trojan C2 Communication
9. threat[10604]:XML Parameter Entity Bloat Leads to Dos
10. threat[28965]:JetBrains TeamCity Global Settings Stored Cross-Site Scripting Vulnerability(CVE-2024-47951)
11. threat[28967]:Netgate pfSense interfaces_groups_edit.php members Stored Cross-Site Scripting Vulnerability(CVE-2024-46538)
12. threat[28968]:Microsoft Windows URL NTLM Relay Vulnerability(CVE-2024-43451)
13. threat[42481]:Mining Trojan JSON-RPC Protocol Mining Pool Submission
14. threat[28969]:vBulletin replaceAdTemplat Remote Code Execution Vulnerability(CVE-2025-48827)
15. threat[28970]:NagiosXI commandline.php SQL Injection Vulnerability(CVE-2018-10735)
16. threat[28971]:NagiosXI logbook.php SQL Injection Vulnerability(CVE-2018-10737)
17. threat[32179]:Glodon OA DataExchange.ashx SQL Injection Vulnerability
18. threat[42480]:tcp-over-dns Tunnel Tool Communication Behavior
19. threat[28973]:Tianbai Online Training System TCH_list SQL Injection Vulnerability
20. threat[32180]:Roundcube Webmail Information Disclosure Vulnerability (CVE-2024-42010)
21. threat[28964]:WordPress Image Hover Effects Ultimate Access Control Error Vulnerability(CVE-2021-36888)
22. threat[32181]:Tongda OA handle.php Authentication Bypass Vulnerability
23. threat[28974]:DB-GPT Path Traversal Arbitrary File Upload Vulnerability(CVE-2024-10902)
24. threat[28975]:DB-GPT DuckDB SQL Injection Vulnerability(CVE-2024-10901/CVE-2024-10835)
25. threat[28976]:LibreNMS Device Overview Stored Cross-Site Scripting Vulnerability(CVE-2024-50352)
26. threat[28977]:LibreNMS AboutController.php Command Injection Vulnerability(CVE-2024-51092)
27. threat[28979]:DB-GPT knowledge Directory Traversal Arbitrary File Write Vulnerability(CVE-2024-10833)
28. threat[28978]:MetaCRM upload3.jsp Arbitrary File Upload Vulnerability
29. threat[32182]:BOSS Foreign Trade Management Software DCreceiveBox.jsp Multiple SQL Injection Vulnerabilities
30. threat[32183]:BOSS Foreign Trade Management Software V6.0 log/logined.jsp SQL Injection Vulnerability
31. threat[32184]:BOSS Foreign Trade Management Software V6.0 loginednew.jsp SQL Injection Vulnerability
32. threat[28982]:llama_index DuckDBVectorStore SQL Injection Vulnerability(CVE-2025-1750)
33. threat[28980]:Jenkins Simple Queue Plugin Stored Cross-Site Scripting Vulnerability(CVE-2024-54003)
34. threat[28981]:CactiEZ weathermap Plugin Arbitrary File Write Vulnerability

update rules:
1. threat[42471]:SideWinder WarHawk Backdoor Task Initiation Request
2. threat[24474]:Oracle Business Intelligence XML Publisher 12.2.1.4.0 - XML External Entity Injection Vulnerability(CVE-2019-2616)
3. threat[32132]:Oracle Fusion Middleware Information Disclosure Vulnerability (CVE-2020-2733)
4. threat[42388]:Mythic C2 Framework Online
5. threat[42462]:Discover Server-Side Request ForgeryBypass Attack Behavior
6. threat[10534]:F5 BIG-IP Format String Vulnerability(CVE-2023-22374)
7. threat[26788]:Wavlink WL-WN535K2_K3 command injection vulnerability (CVE-2022-2486)
8. threat[26394]:ShiKong Zhiyou Enterprise Process Control System formservice SQL Injection Vulnerability
9. threat[26415]:ShiKong Zhiyou Enterprise Process Control System formservice File Upload Vulnerability
10. threat[25823]:E-Office OfficeServer E-Office10 OfficeServer.php File Upload Vulnerability
11. threat[28083]:TOPSEC maincgi.cgi Command Execution Vulnerability
12. threat[26977]:Apache Solr Backup/Restore APIs Remote Command Execution Vulnerability (CVE-2023-50386)
13. threat[24689]:phpMyAdmin 4.x SQL Injection Vulnerability (CVE-2020-5504)
14. threat[27181]:Dahua IPC Improper Authorization Vulnerability(CVE-2021-33044/CVE-2021-33045)
15. threat[42454]:Suspected HTTP Requests Exists XSS Injection Common Event Function
16. threat[62201]:HTTP SQL Injection Attempt Type two
17. threat[26889]:Dahua DSS Digital Monitoring System itcBulletin SQL Injection Vulnerability
18. threat[28571]:Weaver e-Office backend test SQL interface SQL Injection Vulnerability
19. threat[24592]:Elasticsearch Kibana Remote Code Execution Vulnerability(CVE-2019-7609)

Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the Zealot 2.0 intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.40493. The new/improved rules of this upgrade package are:

new rules:
1. threat[28948]:Apache Solr Velocity template injection_1 (CVE-2019-17558)
2. threat[32161]:XAMPP 5.6.8 SQL Injection Vulnerability(CVE-2019-8923)
3. threat[28949]:XAMPP 5.6.8 Cross-site Scripting Injection Vulnerability(CVE-2019-8924)
4. threat[42459]:BlackNET Remote Control Trojan Online
5. threat[42460]:BlackNET Remote Control Trojan Obtain Remote Control Instructions
6. threat[42461]:BlackNET Remote Control Trojan Receive Remote Control Instructions
7. threat[32166]:webTareas Unauthorized Reading of File List Directory Vulnerability(CVE-2020-25734)
8. threat[32165]:Sangfor SSL VPN Client Remote File Download Vulnerability
9. threat[32164]:Seeyon A6 reloadData.jsp User Sensitive Information Disclosure Vulnerability
10. threat[32163]:Apache Tomcat Information Disclosure Vulnerability(CVE-2016-6816)
11. threat[32162]:WordPress Simple Ads Manager Plugin Information Disclosure Vulnerability(CVE-2015-2826)
12. threat[28950]:Globiz Solutions Snowfox CMS selectlanguage.class.php Open Redirect Vulnerability(CVE-2014-9343)
13. threat[42463]:Lazarus APT Uses MagicRAT For C2 Communication
14. threat[32167]:Ivanti Avalanche ResourceFilter doFilter Directory Traversal Vulnerability(CVE-2024-47011)
15. threat[28952]:vLLM PyNcclPipe Communication Service pickle Deserialization Vulnerability (CVE-2025-47277)
16. threat[28951]:Microsoft Windows Management Console Remote Code Execution Vulnerability(CVE-2024-43572)
17. threat[42462]:Discover Server-Side Request ForgeryBypass Attack Behavior
18. threat[42464]:Remcos RAT C2 Communication
19. threat[42465]:APT-C-23 TimerRAT Online
20. threat[42466]:APT-C-23 TimerRAT C2 Communication
21. threat[32168]:Apache Shiro Permission Bypass Vulnerability (CVE-2020-13933)
22. threat[42467]:Ngioweb Botnet Communication
23. threat[42474]:SideWinder WarHawk Backdoor Gathered File Manager Infomation
24. threat[32170]:Lingdang CRM getActionList Interface SQL Injection Vulnerability(CVE-2024-11121)
25. threat[32169]:Lingdang CRM system interface pdf.php Arbitrary File Read Vulnerability
26. threat[28955]:SolarWinds Web Help Desk Deserialization Vulnerability (CVE-2024-28986)
27. threat[32171]:Delta Electronics DIAEnergie SQL Injection Vulnerability (CVE-2024-42417)
28. threat[28956]:AnythingLLM Path Traversal Vulnerability(CVE-2024-13059)
29. threat[42468]:APT-C-35 Spyder Downloader Collect Information
30. threat[42469]:APT-C-35 Spyder Downloader Download Component
31. threat[32172]:OpenEMR SQL Injection Vulnerability(CVE-2024-22611)
32. threat[28957]:MinIO Unauthorized SSRF Vulnerability (CVE-2021-21287)
33. threat[32173]:DB-GPT Arbitrary file deletion Vulnerability(CVE-2025-0452)
34. threat[42470]:SideWinder WarHawk Backdoor Gathered System Information
35. threat[42475]:SideWinder WarHawk Backdoor Upload Files
36. threat[42472]:SideWinder WarHawk Backdoor Task Completion
37. threat[32175]:DedeCMS Arbitrary File Deletion Vulnerability (CVE-2024-33749)
38. threat[28958]:DedeCMS Remote Code Execution Vulnerability (CVE-2024-6940)
39. threat[32174]:NetMizer Log Management System dirlist.php Directory Traversal Vulnerability(CNVD-2017-37549)
40. threat[28959]:ReCrystallize Server Authentication Bypass Vulnerability(CVE-2024-26331)
41. threat[28961]:Grafana Cross-Site Scripting Injection Vulnerability (CVE-2025-4123)
42. threat[28960]:WordPress Plugin Like Button Rating LikeBtn Cross-site Error Code Vulnerability(CVE-2021-24945)
43. threat[28962]:Llama_Index duckdb_retriever SQL Injection Vulnerability(CVE-2024-11958)
44. threat[42473]:SideWinder WarHawk Backdoor Command Execution
45. threat[28940]:Cisco Smart Licensing Utility Unauthorized Access Vulnerability(CVE-2024-20440)

update rules:
1. threat[42149]:SSRF Pseudo-Protocol Attacks Exist In Suspected Request Parameters
2. threat[42449]:Raccoon Stealer v1 C2 Communication
3. threat[10510]:Apache Tomcat WebSocket Infinite Loop Denial of Service Vulnerability(CVE-2020-13935)
4. threat[26389]:Ruijie NBR 1300G Router Ultra Vires CLI Command Execution Vulnerability
5. threat[24465]:Confluence Remote Code Execution Vulnerability (CVE-2019-3396)
6. threat[31510]:HTTP SQL Injection Attempt Type Nine
7. threat[25845]:ysoserial deserialization utilization
8. threat[42322]:Crimson RAT info Command Obtains System Information
9. threat[42323]:Crimson RAT getavs Command Obtains Process Information
10. threat[42454]:Suspected HTTP Requests Exists XSS Injection Common Event Function
11. threat[28715]:Vllm pickle Deserialization Vulnerability(CVE-2024-9052/CVE-2025-32444)
12. threat[42055]:Redis Remote File Deletion (Suspected Cleaning Traces)
13. threat[25946]:Redis Shell Reverse Command Execution
14. threat[63249]:HTTP /etc/passwd Access Attempt
15. threat[41499]:HTTP Request Sensitive Path Access Attempt
16. threat[24915]:Oracle Business Intelligence BIRemotingServlet AMF Insecure Deserialization(CVE-2020-2950)
17. threat[60992]:HTTP URL Param Cross Site Scripting Type Attemp
18. threat[27588]:Minio Authentication Bypass Vulnerability (CVE-2021-41266)
19. threat[31672]:Lingdang CRM System getOrderList Interface SQL Injection Vulnerability
20. threat[24384]:Mitel Connect ONSITE and Mitel ST conferencing Remote Code Execution(CVE-2018-5782)
21. threat[26010]:Alibaba Nacos Authentication Bypass Vulnerability (CVE-2021-29441)
22. threat[42388]:Mythic C2 Framework Online
23. threat[28240]:PHP webshell access

Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the Zealot 2.0 intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.40398. The new/improved rules of this upgrade package are:


new rules:
1. threat[32149]:Panabit Panalog singleuser_action.php Arbitrary User Creation Vulnerability
2. threat[28925]:PHPMyWind 5.6 Command Injection Vulnerability(CVE-2021-39503)
3. threat[28926]:TensorFlow YAML Arbitrary Code Execution Vulnerability(CVE-2021-37678)
4. threat[28924]:Weaver OA9 uploadimage Arbitrary File Upload Vulnerability
5. threat[28927]:MongoDB Unauthorized Access
6. threat[10602]:TensorFlow AudioSpectrogram Denial of Service Vulnerability(CVE-2023-25666)
7. threat[32152]:EasyImage down.php Arbitrary File Read Vulnerability
8. threat[28928]:DataEase JWT Arbitrary Forgery Vulnerability (CVE-2024-52295)
9. threat[32153]:China Mobile Yu Router ExportSettings.sh Sensitive Information Leakage Vulnerability(CNVD-2020-67110)
10. threat[42453]:GTalkTrojan C2 Communication
11. threat[28929]:Ivanti Endpoint Manager EventHandler.asmx RecordBrokenApp SQL Injection Vulnerability(CVE-2024-29825)
12. threat[42454]:Suspected HTTP Requests Exists XSS Injection Common Event Function
13. threat[42452]:Network Tunneling Tool Regeorg Communication _3
14. threat[28930]:MCMS 5.2.5 content/list SQL Injection Vulnerability(CVE-2022-23898)
15. threat[28931]:MCMS 5.2.5 search.do SQL Injection Vulnerability (CVE-2022-23899)
16. threat[32154]:LiveNVR Streaming Service Software channeltree Unauthorized Access Vulnerability
17. threat[42455]:HTTPBrowser RAT C2 Communication
18. threat[42456]:HTTPBrowser RAT Send Command
19. threat[28933]:Ivanti Endpoint Manager Mobile Authentication Bypass and Remote Code Execution Vulnerability(CVE-2025-4427/CVE-2025-4428)
20. threat[28932]:MQTT Unauthorized Vulnerability
21. threat[28934]:BEESCMS admin_book.php SQL Injection Vulnerability
22. threat[42457]:Lumma Stealer Trojan C2 Communication
23. threat[28935]:Netgear ProSAFE NMS300 UpLoadServlet Unrestricted File Upload Vulnerability(CVE-2024-5247)
24. threat[28936]:TOTOLINK NR1800X Command Injection Vulnerability (CVE-2022-41518/CVE-2022-44249/CVE-2022-44250/CVE-2022-44251)
25. threat[28937]:langchain-experimental arbitrary code execution vulnerability (CVE-2024-21513)
26. threat[42458]:Redline Stealer Trojan Data Active Online Behavior
27. threat[28938]:D-Link DIR-820L Command Injection Vulnerability (CVE-2022-26258)
28. threat[32155]:CLTPHP Database.php Any File Deletion Vulnerability
29. threat[28943]:Centreon Web updateServiceHost_MC SQL Injection Vulnerability(CVE-2024-32501)
30. threat[28942]:Cisco Smart Licensing Utility Trust Management Issue Vulnerability(CVE-2024-20439)
31. threat[28941]:WordPress Plugin Order Delivery Date Privilege Escalation Vulnerability(CVE-2025-2907)
32. threat[28939]:Bootstrap Cross-Site Scripting Vulnerability(CVE-2025-47204)
33. threat[28947]:Cacti Group Cacti links.php Console Section Name Stored Cross-Site Scripting Vulnerability(CVE-2024-43365)
34. threat[28944]:Kemp LoadMaster read_pass Command Injection Vulnerability(CVE-2024-7591)
35. threat[28945]:Ivanti Endpoint Manager serverMotherboard LoadSlotsTable SQL Injection Vulnerability(CVE-2024-34783)
36. threat[32156]:D-link Dir-605 B2 Information Disclosure Vulnerability(CVE-2021-40654)
37. threat[32157]:Huawei DG8045 deviceinfo Information Leakage Vulnerability
38. threat[32158]:MediaWiki CSS Extension Path Traversal Vulnerability(CVE-2024-47841)
39. threat[28946]:NVIDIA TensorRT-LLM pickle deserialization Vulnerability(CVE-2025-23254)
40. threat[32159]:Apache Axis2 1.4.1 Local File Inclusion Vulnerability
41. threat[32160]:MetaCRM mcc_login.jsp SQL Injection Vulnerability


update rules:
1. threat[28872]:Microsoft Exchange Server Remote Code Execution Vulnerability Attack (CVE-2021-34473)_2
2. threat[30888]:Yongyou CHANJET T+ Ufida.T.SM.UIP.MultiCompanyController,Ufida.T.SM.UIP.ashx SQL Injection Vulnerability
3. threat[25740]:Linux Shell Reverse Hidden Command Execution
4. threat[42083]:Exchange Server Server Request Forgery Information Leakage Vulnerability
5. threat[25689]:Jenkins Rundeck Plugin Stored Cross-Site Scripting Vulnerability(CVE-2022-30956)
6. threat[25218]:JBoss 5.x and 6.x Deserialization Vulnerabilities (CVE-2017-12149)
7. threat[31425]:Glodon OA GetAllUsersXml Information Disclosure Vulnerability
8. threat[28077]:Horde Groupware Webmail Edition Remote Command Execution Vulnerability
9. threat[42221]:Lumma Stealer Trojan Online Requests
10. threat[42222]:Lumma Stealer Trojan Negotiating Configuration Information
11. threat[42223]:Lumma Stealer Trojan Sends Cryptic Messages
12. threat[41887]:Ngrok Intranet Penetration Tool Communication
13. threat[24302]:Suspicious XML External Entity(XXE) Injection Attempt
14. threat[24908]:Mikrotik Router Monitoring System 1.2.3 SQL Injection(CVE-2020-13118)


Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the Zealot 2.0 intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.40295. The new/improved rules of this upgrade package are:

new rules:
1. threat[28894]:LDAP Injection Attack Attempt
2. threat[28895]:WordPress plugin Tawk.To Live Chat Cross-site Request Forgery Vulnerability(CVE-2021-24914)
3. threat[28896]:Craft CMS Remote Code Execution Vulnerability(CVE-2025-32432)
4. threat[32145]:GLPI Pre-Authentication SQL Injection Vulnerability(CVE-2025-24799)
5. threat[28897]:GLPI Pre-Authentication Remote Code Execution Vulnerability (CVE-2025-24801)
6. threat[28899]:PyTorch Distributed RPC Framework Remote Code Execution Vulnerability(CVE-2024-5480)
7. threat[42440]:Telnet Server NTLM Authentication Bypass Vulnerability
8. threat[28900]:Microsoft Telnet Server Guest User Login Bypass Vulnerability
9. threat[28902]:Jumpserver Arbitrary Password Reset Vulnerability (CVE-2023-42820)
10. threat[32146]:WordPress plugin Advanced Access Manager aam-media=wp-config.php Arbitrary File Read Vulnerability
11. threat[28898]:ThinkPHP Deserialization Arbitrary Command Execution Vulnerability (CVE-2024-48112)
12. threat[28901]:EyouCMS v.1.6.5 Cross-site Scripting Attack Vulnerability(CVE-2024-22927)
13. threat[28903]:PyTorch Distributed RPC Framework RemoteModule Deserialization Vulnerability(CVE-2024-48063)
14. threat[28905]:Ketuo Total Intelligent Parking Charging System DoubtCarNoListFrom.aspx SQL Injection Vulnerability
15. threat[28907]:DedeCMS SSTI Template Injection Remote Code Execution Vulnerability
16. threat[28906]:HP Integrated Lights-Out 4 Remote Command Execution Vulnerability(CVE-2017-12542)
17. threat[28908]:Kentico CMS Remote Code Execution Vulnerability(CVE-2019-10068)
18. threat[28909]:Ruijie-EWEB patch.php Command Injection Vulnerability
19. threat[28910]:Apache Pinot Authentication Bypass Vulnerability(CVE-2024-56325)
20. threat[42441]:Sorillus C2 Tool Communication Behavior
21. threat[42442]:Prometei Botnet Connects To The C2 Server
22. threat[42443]:DragonOK Backdoor Uploads Files
23. threat[28904]:Erlang/OTP SSH Remote Code Execution Vulnerability(CVE-2025-32433)
24. threat[28911]:SonicWALL SSLVPN Security Vulnerability(CVE-2024-53704)
25. threat[42444]:DragonOK Backdoor Download Files
26. threat[28912]:Simple Chatbot Application SystemSettings.php Remote Code Execution Vulnerability
27. threat[28913]:TOTOLINK A7100RU Command Injection Vulnerability(CVE-2022-28583)
28. threat[28914]:Joomla Component GMapFP Arbitrary File Upload Vulnerability(CNVD-2020-19945)
29. threat[28915]:D-Link D-View executeWmicCmd Command Injection Vulnerability(CVE-2024-5297)
30. threat[28916]:Ivanti Avalanche FileStoreConfig Arbitrary File Upload Vulnerability(CVE-2024-29848)
31. threat[42445]:PlugX Worm Communicate
32. threat[42447]:Raccoon Stealer v2 C2 Communication
33. threat[28917]:Tongda OA v11.2 upload.php Background Arbitrary File Upload Vulnerability
34. threat[42446]:Suspected GTP Protocol False Message Communication
35. threat[42448]:Raccoon Stealer v2 Sent Infomation To C2 Server
36. threat[28923]:openBI /screen/exportLarge code issue vulnerability(CVE-2024-1032)
37. threat[28919]:Razer Sila Genie Magic Box Router Command Injection Vulnerability (CVE-2022-29013)
38. threat[28918]:openBI ploadIcon Arbitrary File Upload Vulnerability(CVE-2024-1035)
39. threat[32147]:NSFOCUS SAS Bastion Host local_user.php Permission Bypass Vulnerability
40. threat[28920]:NSFOCUS SAS Bastion Exec Remote Command Execution Vulnerability
41. threat[32148]:NSFOCUS SAS Bastion Machine GetFile Arbitrary File Read Vulnerability
42. threat[28921]:F5 BIG-IP iControl REST Command Injection Vulnerability(CVE-2025-31644)
43. threat[42450]:Ccremote C2 Tool Communication Behavior
44. threat[42451]:Dwsercice Remote Control Tool Communication Behavior
45. threat[28922]:openBI /websocket/Setting/set Command Execution Vulnerability(CVE-2024-1115)
update rules:
1. threat[25475]:Apache Log4j2 Remote Code Execution Vulnerability(CVE-2021-44228/CVE-2021-45046)
2. threat[42179]:Suspected malicious file download
3. threat[25771]:ThinkPHP multilingual function Remote Code Execution Vulnerability(CVE-2022-47945)
4. threat[25727]:Linux/Windows Sample Download Command Execution
5. threat[25598]:VMware Spring Cloud Function SpEL Code Injection Vulnerability(CVE-2022-22963)
6. threat[41499]:HTTP Request Sensitive Path Access Attempt
7. threat[24434]:Supervisord Remote Command Execution Vulnerability(CVE-2017-11610)
8. threat[27718]:TOTOLINK A6000R webcmd Remote Command Execution Vulnerability
9. threat[31608]:Yonyou U8 Cloud FileServlet Arbitrary File Read Vulnerability
10. threat[42147]:HTTP Sensitive Parameters Execute Arbitrary Command Attempt
11. threat[10510]:Apache Tomcat WebSocket Infinite Loop Denial of Service Vulnerability(CVE-2020-13935)
12. threat[60993]:HTTP Cross Site Generic Scripting Attempt
13. threat[26397]:ESAFENET UploadFileFromClientServiceForClient Arbitrary File Upload Vulnerability(CNVD-2023-59471)
14. threat[24502]:Reflective XSS injection attack
15. threat[26873]:Dahua Smart Park Integrated Management Platform poi Arbitrary File Upload Vulnerability
16. threat[31510]:HTTP SQL Injection Attempt Type Nine
17. threat[63682]:HTTP SQL Injection Attempt Type Three
18. threat[27759]:Livebos Uploadimage.Do Arbitrary File Upload Vulnerability
19. threat[30963]:Qi'anxin vpn Unauthorized Management User Traversal Vulnerability
20. threat[62201]:HTTP SQL Injection Attempt Type two
21. threat[26317]:Huatian Power OA Version 8000 WorkFlowService SQL Injection Vulnerability
22. threat[31442]:Glodon OA Emailaccountorguserservice SQL Injection Vulnerabilities
23. threat[60245]:HTTP SQL Injection Attempt Type Eight
24. threat[31434]:Weaver E-Mobile System Interface cdnfile Arbitrary File Read Vulnerability
25. threat[23522]:TOTOLINK Routers formSysCmd Remote Command Execution Vulnerability(CVE-2020-25499)
26. threat[31502]:Simple School Managment System SQL Injection Vulnerability(CVE-2024-25304)
27. threat[31503]:Simple School Managment System SQL Injection Vulnerability(CVE-2024-25306)
28. threat[26363]:Jeecg-boot JDBC testConnection arbitrary code execution vulnerability
29. threat[25121]:SaltStack Salt API SSH Client Command Injection Vunlerability (CVE-2020-16846)
30. threat[27349]:LiveBos crm ScriptVariable.jsp Remote Code Execution Vulnerability
31. threat[24538]:Xstream Deserializable Remote Code Execution Vulnerability(CVE-2013-7285/CVE-2019-10173)
Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the Zealot 2.0 intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.40168. The new/improved rules of this upgrade package are:

new rules:
1. threat[42437]:APT-C-35 Spyder Downloader Heartbeat Detection_1
2. threat[42438]:APT-C-35 Spyder Downloader Heartbeat Detection_2
3. threat[32139]:LyLme Spage SQL Injection Vulnerability (CVE-2023-45951)
4. threat[42439]:NimPlant C2 Framework Communication
5. threat[32140]:Citrix Application report Privilege Bypass Vulnerability
6. threat[32141]:WordPress RegistrationMagic Authentication Bypass Vulnerability(CVE-2021-4073)
7. threat[28882]:WordPress Data Access Plugin SQL Injection Vulnerability(CVE-2021-24866)
8. threat[32142]:Taocms path Arbitrary File Read Delete Vulnerability(CVE-2021-46203)
9. threat[28883]:Tenda AC9 SetSysTimeCfg Command Injection Vulnerability(CVE-2022-36273)
10. threat[28885]:Weaver OA ReceiveTodoRequestByXml XML Entity Injection Vulnerability
11. threat[28884]:Tenda AC9 SetIPTVCfg Remote Command Execution Vulnerability(CVE-2022-25438)
12. threat[10601]:Apache Log4j Denial of Service Vulnerability (CVE-2021-45105)
13. threat[28888]:ZoneMinder Remote Command Execution Vulnerability (CVE-2023-26035)
14. threat[28886]:SSI Command Injection Attack
15. threat[28889]:Contao Remote Code Execution Vulnerability(CVE-2022-26265)
16. threat[28890]:Suspected HTTP request exists Python Jinja2 template injection _2
17. threat[28891]:Totolink Routers X5000R and A7000R Command Injection Vulnerability(CVE-2022-27004)
18. threat[28892]:D-Link Command Inject Vulnerability(CVE-2022-28573)
19. threat[32143]:74cms Arbitrary File Read Vulnerability
20. threat[28887]:Adobe ColdFusion Access Control Vulnerability(CVE-2023-38205)
21. threat[32144]:Tsinghua Unigroup Archives Management System Directory Traversal Vulnerability (CVE-2025-0225/CVE-2025-0226/CVE-2025-0227)
22. threat[28893]:WordPress plugin Temporary Login Without Password Cross-Site Request Forgery Vulnerability(CVE-2021-24836)
update rules:
1. threat[27694]:Fanwei E-Mobile system installOperate interface SSRF vulnerability
2. threat[60471]:HTTP Directory Traversal Access /etc/passwd
3. threat[42434]:APT-C-35 Spyder Downloader Online_2
4. threat[62203]:HTTP Command Injection Attempt
5. threat[40958]:Backdoor/Trojan Webshell Detection
6. threat[68655]:Suspicious Webshell Backdoor Access and Control
7. threat[27402]:Java FreeMarker template injection exists in the suspected request parameter
8. threat[27402]:Suspected HTTP request exists Java FreeMarker template injection
9. threat[28843]:Langflow Remote Code Execution Vulnerability(CVE-2025-3248)
10. threat[50652]:XML External Entity Injection (XXE)-(HTML Entity Encoding/UTF-16/UTF-7)
11. threat[28526]:ZZZCMS zzzphp Remote Command Injection Vulnerability(CVE-2022-23881)
12. threat[27399]:Python Jinja2 template injection exists in the suspected request parameter
13. threat[27399]:Suspected HTTP request exists Python Jinja2 template injection
14. threat[27396]:Suspected HTTP requests exists PHP Twig template injection
15. threat[25740]:Linux Shell Reverse Hidden Command Execution
16. threat[25748]:Linux Information Collection Hidden Command Execution
17. threat[27107]:Linux Information Collection Command Type Three
18. threat[63249]:HTTP /etc/passwd Access Attempt
19. threat[31510]:HTTP SQL Injection Attempt Type Nine
20. threat[63682]:HTTP SQL Injection Attempt Type Three
21. threat[60245]:HTTP SQL Injection Attempt Type Eight
22. threat[25727]:Linux/Windows Sample Download Command Execution
23. threat[26701]:Expression Injection Attack-Expression Evaluation
24. threat[28059]:Kingdee EAS /easportal/tools/appUtil.jsp Arbitrary File Upload Vulnerability
25. threat[25703]:Craft CMS SEOmatic Server-Side Template Injection Vulnerability(CVE-2020-9757)
26. threat[24300]:Remote command execution vulnerability of GPON Home Gateway (cve-2018-10561/cve-2018-10562)
27. threat[24645]:AVTECH video surveillance device adcommand.cgi remote command execution vulnerability
28. threat[24255]:Web Service Remote Command Execution Attack
29. threat[27106]:Windows Information Collection Command Type Three
30. threat[25747]:Windows Information Collection Command Execution
31. threat[25746]:Linux Information Collection Command Execution (Request Parameters)
32. threat[25780]:Apache Airflow Code Injection Vulnerability (CVE-2022-40127)
33. threat[27088]:JumpServer Remote Code Execution Vulnerability (CVE-2024-29202/CVE-2024-40629)
Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the Zealot 2.0 intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.40103. The new/improved rules of this upgrade package are:

new rules:
1. threat[32126]:BlogEngine CMS Open Redirect Vulnerability(CVE-2023-33405)
2. threat[28872]:Microsoft Exchange Server Remote Code Execution Vulnerability Attack (CVE-2021-34473)_2
3. threat[28873]:Angular Expressions Sandbox Escape Arbitrary Code Execution Vulnerability (CVE-2024-54152)
4. threat[42432]:Suo5 Tunnel Tool Communication_3
5. threat[32127]:Bazaar Arbitrary File Read Vulnerability (CVE-2024-40348)
6. threat[32128]:Docassemble Arbitrary File Read Vulnerability (CVE-2024-27292)
7. threat[28874]:Yonyou U8 Cloud ServiceDispatcherServlet Deserialization Vulnerability_2
8. threat[32130]:ipTIME A2004 Information Disclosure Vulnerability (CVE-2024-54763/CVE-2024-54764)
9. threat[32129]:Yonyou U8 CRM timeoutlogin interface Unauthorized access Vulnerability
10. threat[28876]:Bacardi CMS Micro Mall Command Injection(CNVD-2021-12798)
11. threat[32131]:Baijia CMS Microstore File Deletion Vulnerability(CNVD-2021-16017)
12. threat[28877]:Baidu WebUploader component arbitrary file upload Vulnerability(CNVD-2018-26054)
13. threat[32132]:Oracle Fusion Middleware Information Disclosure Vulnerability (CVE-2019-2616)
14. threat[32133]:pyLoad Information Disclosure Vulnerability (CVE-2024-21644)
15. threat[32134]:RaidenMAILD Mail Server Directory Traversal Vulnerability (CVE-2024-32399)
16. threat[32105]:Tenda AC1200 Authentication Bypass Vulnerability (CVE-2022-40843)
17. threat[32135]:Maple Wireless Management System exportConfigByHttp Information Disclosure Vulnerability
18. threat[42433]:Patchwork APT Spyder Downloader Online
19. threat[28878]:Ketuo Total Intelligent Parking Charging System T_SellFrom.aspx SQL Injection Vulnerability
20. threat[32138]:Suzhou Kedar Technology Multimedia Recording System Information Leakage Vulnerability
21. threat[42434]:Patchwork APT Spyder Downloader Online_2
22. threat[42435]:Patchwork APT Spyder Downloader Online_3
23. threat[32136]:SimpleHelp Directory Traversal Vulnerability (CVE-2024-57727)
24. threat[32137]:Wyrestorm Apollo VX20 Information Disclosure Vulnerability (CVE-2024-25735)
25. threat[28879]:NoSQL Injection Attack
26. threat[28880]:SAP NetWeaver Visual Composer Metadata Uploader Arbitrary File Upload Vulnerability (CVE-2025-31324)
27. threat[28881]:JizhiCMS website builder system backend SQL injection vulnerability(CVE-2022-36578)
28. threat[28875]:Commvault Command Center Remote Code Execution Vulnerability(CVE-2025-34028)
update rules:
1. threat[28798]:Shenzhou Digital DCME-520 mon_merge_stat_hist.php Command Injection Vulnerability(CVE-2025-3002)
2. threat[24302]:Suspicious XML External Entity(XXE) Injection Attempt
3. threat[27786]:Zhenyun SRM Cloud Platform Public SpEL Expression Injection Vulnerability
4. threat[42067]:lockerBot Botnet Communication
5. threat[27513]:Yonyou U8 Cloud ServiceDispatcherServlet Deserialization Vulnerability
6. threat[26357]:Jeecg-Boot Freemarker Template Injection Vulnerability(CVE-2023-4450)
7. threat[32111]:Tenda AC1200 Password Exposure Vulnerability (CVE-2022-40845)
8. threat[31452]:Shibang Communications IP Network Intercom Broadcasting System rj_get_token.php Arbitrary File Reading Vulnerability
9. threat[32055]:WordPress StopBadBots Plugin SQL Injection Vulnerability (CVE-2021-24727)
10. threat[28771]:CrushFTP Authentication Bypass Vulnerability (CVE-2025-2825)
11. threat[24474]:Oracle Business Intelligence XML Publisher 12.2.1.4.0 - XML External Entity Injection Vulnerability
12. threat[10596]:5G Infrastructure GTP-U In GTP-U Denial Of Service Vulnerability(CVE-2021-45462)
13. threat[28823]:NoSQL Injection Attack Behavior
Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the Zealot 2.0 intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.40024. The new/improved rules of this upgrade package are:

new rules:
1. threat[32083]:Smart Office Web 20.28 - Information Disclosure Vulnerability(CVE-2022-47075)
2. threat[32084]:JeecgBoot SQL Injection Vulnerability(CVE-2024-57606)
3. threat[32081]:OpenCATS Open Redirect Vulnerability (CVE-2023-27292)
4. threat[32082]:Uncanny Toolkit for LearnDash URL Redirect Vulnerability (CVE-2023-34020)
5. threat[28845]:Mura CMS Authentication Bypass Vulnerability (CVE-2022-47003)
6. threat[42424]:Microsoft Skype for Business Server Server-Side Request Forgery Vulnerability (CVE-2023-41763)
7. threat[32087]:Securepoint Unified Threat Management Information Disclosure Vulnerability (CVE-2023-22620)
8. threat[28846]:MSNSwitch Firmware Authentication Bypass (CVE-2022-32429)
9. threat[28847]:modoboa Email Management Platform Improper Authorization Vulnerability (CVE-2023-2227)
10. threat[42425]:Suo5 Tunnel Tool Communication _2
11. threat[32085]:Payment Gateway for Telcell Open Redirect Vulnerability (CVE-2023-6786)
12. threat[32086]:WordPress Paytm Payment Gateway Plugin Server-Side Request Forgery Vulnerability (CVE-2022-45362)
13. threat[50672]:Todesk Remote Control Tool Connection Establishment Behavior
14. threat[28848]:Drogon Access Control Error Vulnerability(CVE-2022-25297)
15. threat[32088]:Wordpress Autoptimize Information Disclosure Vulnerability(CVE-2022-4057)
16. threat[32089]:SearchWP Live Ajax Search Unauthenticated Information Disclosure Vulnerability(CVE-2022-2535)
17. threat[32090]:PHPIPAM Unauthorized Vulnerability(CVE-2023-0678)
18. threat[32091]:WordPress Plugin WPQA Builder Information Disclosure Vulnerability (CVE-2022-1598)
19. threat[32092]:WordPress Simple Ajax Chat Sensitive Information Disclosure Vulnerability(CVE-2022-27849)
20. threat[28849]:PowerJob Arbitrary User Registration Vulnerability(CVE-2023-29922)
21. threat[32070]:WordPress Download Monitor Sensitive Information Disclosure(CVE-2022-45354)
22. threat[32093]:WordPress Prime Mover Sensitive Data Leak Vulnerability(CVE-2023-6505)
23. threat[32094]:Reprise License Manager Information Disclosure Vulnerability(CVE-2022-28365)
24. threat[28850]:Reprise Software Reprise License Manager Cross-Site Scripting Vulnerability(CVE-2022-28363)
25. threat[32095]:WordPress Popup by Supsystic Subscriber Email Address Disclosure Vulnerability(CVE-2022-0424)
26. threat[32096]:WordPress Simply Schedule Appointments Information Disclosure Vulnerability(CVE-2022-2373)
27. threat[32099]:WordPress Sitemap by click5 Unauthorized Vulnerability(CVE-2022-0952)
28. threat[32098]:PMB Open Redirect Vulnerability (CVE-2023-24735)
29. threat[32097]:WordPress Easy Student Results Improper Authorization Vulnerability(CVE-2022-2379)
30. threat[32100]:WordPress Redux framework sensitive information leakage vulnerability(CVE-2021-38314)
31. threat[28851]:SAP Knowledge Warehouse Cross-Site Scripting Vulnerability(CVE-2021-42063)
32. threat[32101]:PowerCreator Interface OpenPublicCourse.aspx SQL Injection Vulnerability
33. threat[32102]:PowerCreator Interface CatalogCourse.aspx SQL Injection Vulnerability
34. threat[32103]:PowerCreator ShowResourceSkillComment.aspx SQL Injection Vulnerability
35. threat[32104]:WordPress Toolbar Plugin Open Redirect Vulnerability (CVE-2023-6389)
36. threat[28853]:Apache Commonscollections Deserialization Command Injection Vulnerability (CC10)
37. threat[32106]:Weaver E-Mobile Data/downfile.chp arbitrary file read vulnerability
38. threat[28854]:Apache Commonscollections Deserialization Command Injection Vulnerability (CC11)
39. threat[32107]:Dolibarr Information Disclosure Vulnerability (CVE-2023-33568)
40. threat[32112]:WordPress Plugin External Media without Import Backend Server Request Forgery Vulnerability (CVE-2022-1398)
41. threat[32066]:WordPress Fusion Builder Server-Side Request Forgery Vulnerability (CVE-2022-1386)
42. threat[32111]:Tenda AC1200 Password Exposure Vulnerability (CVE-2022-40845)
43. threat[28858]:Tenda AC1200 Command Execution Vulnerability (CVE-2022-40847)
44. threat[28857]:Xunyi Technology 74cms SQL Injection Vulnerability (CVE-2020-22210)
45. threat[32113]:WordPress Plugin Formcraft Background Server Request Forgery Vulnerability (CVE-2022-0591)
46. threat[28859]:Tenda AC1200 Command Execution Vulnerability(CVE-2022-41396)
47. threat[28860]:Tenda AC1200 Command Injection Vulnerability(CVE-2022-41395)
48. threat[42429]:Upload The Sensitive Script File _Filename RFC2047 Encoding Bypass
49. threat[42430]:Sensitive Script File Upload - Multi-Form Upload Bypass
50. threat[28862]:TP-Link Command Injection Vulnerability(CVE-2021-41653)
51. threat[28861]:Langsu ERP System UploadAjaxAPI.ashx File Upload Vulnerability(CVE-2025-1646)
52. threat[28863]:OnJet ERP cwsqry.asmx SQL Injection Vulnerability
53. threat[32115]:iSpy Authentication Bypass Vulnerability (CVE-2022-29775)
54. threat[28864]:OnJet ERP cwsapprove.asmx SQL Injection Vulnerability
55. threat[28865]:Yonyou NC-Cloud fs Server Authentication Bypass Vulnerability
56. threat[28866]:Monthly Club ERP Management Cloud Platform Handler.ashx Arbitrary File Upload Vulnerability
57. threat[32116]:Wordpress Shareaholic Information Leak Vulnerability (CVE-2022-0594)
58. threat[28867]:Jolokia Agent JNDI Injection Vulnerability (CVE-2018-1000130)
59. threat[42431]:Bore Tunnel Tool Communication Behavior
60. threat[32117]:WordPress plugin Metform Sensitive Information Disclosure Vulnerability(CVE-2022-1442)
61. threat[32118]:MLFlow Sensitive Information Disclosure Vulnerability(CVE-2023-43472)
62. threat[28868]:WordPress All-In-One Video Gallery Server-Side Request Forgery Vulnerability(CVE-2022-2633)
63. threat[32119]:PHP Scripts Mall Schools Alert Management Script Arbitrary File Read Vulnerability (CVE-2018-12054)
64. threat[28869]:Kavita Server-Side Request Forgery Vulnerability (CVE-2022-2756)
65. threat[32120]:WAVLINK WN530HG4 Improper Access Control Vulnerability(CVE-2022-34047)
66. threat[32121]:WordPress Page Builder KingComposer Plugin Open Redirect Vulnerability(CVE-2022-0165)
67. threat[28852]:Huang Yaoshi Pharmaceutical Management Software XSDService.asmx File Upload Vulnerability(CVE-2024-56829)
68. threat[28855]:GuangZhou Tucron Library Management System Logic Bypass Vulnerability
69. threat[32108]:Interlib Library System downLoad Any File Reading Vulnerability
70. threat[32109]:HONGFAN OA UserForm.asmx SQL Injection Vulnerability
71. threat[28856]:HONGFAN OA imgupload.aspx Arbitrary File Upload Vulnerability
72. threat[32110]:HONGFAN OA /anon/list SQL Injection Vulnerability
73. threat[32114]:WordPress Transposh Information Disclosure Vulnerability(CVE-2022-2462)
74. threat[32122]:Fangzheng Media Editorial System getUserInfo.do Interface Information Leakage Vulnerability
75. threat[32123]:Hunan Construction Engineering Research Quality Inspection System InstrumentUsageRecordExport Arbitrary File Read Vulnerability
76. threat[32125]:Oracle E-Commerce Suite lcmServiceController.jsp SSRF Vulnerability(CVE-2018-3167)
77. threat[28871]:Anyscale Ray Server Request Forgery Vulnerability (CVE-2023-48023)
78. threat[28870]:WiseGiga NAS group.php Remote Command Execution Vulnerability
79. threat[32124]:WiseGiga NAS down_data.php Arbitrary File Download Vulnerability
80. threat[28839]:Digital Watchdog DW MEGApix IP Cross-site Scripting Vulnerability(CVE-2022-34537)
81. threat[50251]:Remote Control Tool TeamViewer Connection Control
update rules:
1. threat[26283]:Sophos Firewall Code Execution Vulnerability (CVE-2022-1040)
2. threat[50652]:XML External Entity Injection (XXE)-(HTML Entity Encoding/UTF-16/UTF-7)
3. threat[28837]:llama.cpp rpc_tensor arbitrary address write Vulnerability(CVE-2024-42479)
4. threat[24481]:Oracle WebLogic Server FileDistributionServlet Information Disclosure(CVE-2019-2615)
5. threat[26429]:u5cms URL Redirection Vulnerability (CVE-2022-32444)
6. threat[25396]:JBoss Application Server JMXInvokerServlet Deserialization Vulnerability(CVE-2015-7501)
7. threat[60588]:PHP Arbitrary File Location Upload Vulnerability
8. threat[28483]:NUUO webcam upload.php interface Arbitrary File Upload Vulnerability(CVE-2018-11523)
9. threat[25437]:WordPress Automattic WooCommerce Blocks Plugin SQL Injection Vulnerability(CVE-2021-32789)
10. threat[28823]:NoSQL Injection Attack Behavior
11. threat[26047]:XStream Deserialization File Deletion Vulnerability (CVE-2021-21343)
12. threat[26048]:XStream Deserialization Command Injection Vulnerability (CVE-2020-26217)
13. threat[26049]:XStream Deserialization Server Request Forgery Vulnerability (CVE-2021-21342)
14. threat[26007]:XStream Deserialization Remote Code Execution Vulnerability (CVE-2021-39144)
15. threat[26008]:XStream Deserialization Remote Code Execution Vulnerability (CVE-2021-39149)
16. threat[28059]:Kingdee EAS /easportal/tools/appUtil.jsp Arbitrary File Upload Vulnerability
17. threat[26023]:XStream Deserialization Remote Code Execution Vulnerability (CVE-2021-39147)
18. threat[26018]:XStream Deserialization Remote Code Execution Vulnerability (CVE-2021-39145)
19. threat[26022]:XStream Deserialization Remote Code Execution Vulnerability (CVE-2021-39146/CVE-2021-39154)
20. threat[26024]:XStream Deserialization Remote Code Execution Vulnerability (CVE-2021-39148)
21. threat[26046]:XStream Deserialization Server Request Forgery Vulnerability (CVE-2021-21349)
22. threat[10544]:XStream Denial of Service Vulnerability (CVE-2021-21341)
23. threat[10545]:XStream Denial of Service Vulnerability (CVE-2021-21348)
24. threat[26219]:XStream Deserialization Remote Code Execution Vulnerability (CVE-2021-39139)
25. threat[10546]:XStream Denial of Service Vulnerability (CVE-2021-39140)
26. threat[26223]:XStream Deserialization Code Execution Vulnerability (CVE-2021-39141)
27. threat[26224]:XStream Deserialization SSRF Vulnerability (CVE-2021-39150)
28. threat[26225]:XStream Deserialization Code Execution Vulnerability (CVE-2021-39151)
29. threat[26226]:XStream Deserialization SSRF Vulnerability (CVE-2021-39152)
30. threat[26231]:XStream Deserialization Code Execution Vulnerability (CVE-2021-39153)
31. threat[26325]:Tongda OA gateway foreground deserialization vulnerability
32. threat[28153]:Calibre Remote Code Execution Vulnerability (CVE-2024-6782)
33. threat[42222]:Lumma Stealer Trojan Negotiating Configuration Information
34. threat[42223]:Lumma Stealer Trojan Sends Cryptic Messages
35. threat[28768]:Dell EMC iDRAC7 and iDRAC8 Code Injection Vulnerability (CVE-2018-1207)
36. threat[31735]:Easy Appointments Information Disclosure Vulnerability(CVE-2022-0482)
37. threat[25932]:Beanshell Deserialization Code Injection Vulnerability
38. threat[25923]:JDK 7u21 deserialization code injection vulnerability
39. threat[25924]:JDK 8u20 Deserialization Code Injection Vulnerability
40. threat[25845]:ysoserial deserialization utilization
41. threat[26932]:Landray OA sysSearchMain.do XMLdecode Deserialization Vulnerability
42. threat[30759]:Zoho ManageEngine Applications Manager UploadAction Arbitrary File Upload Vulnerability (CVE-2020-14008)
43. threat[32054]:Apache Solr on Windows Path Discovery Vulnerability(CVE-2024-52012)
44. threat[28859]:Tenda AC1200 Command Injection Vulnerability(CVE-2022-41396)
45. threat[31374]:Hitachi Vantara Pentaho Information Breach Vulnerability (CVE-2021-31601)
46. threat[26314]:Wangshen SecSSL 3600 Secure Access Gateway System Arbitrary Password Modification Vulnerability
47. threat[31891]:Ivanti-EPM Absolute Path Traversal Vulnerability (CVE-2024-13159)
48. threat[31891]:Ivanti-EPM Absolute Path Traversal Vulnerability (CVE-2024-13159/CVE-2024-13161)
49. threat[31649]:Zabbix SQL Injection Vulnerability (CVE-2024-42327)
50. threat[31292]:Jquery FileTree Path Traversal Vulnerability (CVE-2017-1000170)
51. threat[28799]:JSONPath Plus Security Vulnerability(CVE-2025-1302)
52. threat[26502]:Juniper Networks Junos OS EX Arbitrary File Read Vulnerability (CVE-2023-36845)
53. threat[27389]:Seeyon OA fileUpload.do Foreground File Upload Bypass Vulnerability
54. threat[26543]:XXL-JOB Background Task Command Execution Vulnerability (CVE-2022-40929/CVE-2023-48089)
55. threat[25930]:Oracle E-Business Suite Unauthenticated RCE(CVE-2022-21587)
Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the Zealot 2.0 intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.39851. The new/improved rules of this upgrade package are:

new rules:
1. threat[28807]:WordPress Contact Form 7 Plugin Cross-site Scripting Vulnerability(CVE-2022-0595)
2. threat[32045]:Atlassian Jira Gantt-Chart Cross-Site Scripting Vulnerability(CVE-2020-15944)
3. threat[32044]:webTareas Cross-Site Script Injection Vulnerability (CVE-2022-44957)
4. threat[28812]:Leadshop Arbitrary Code Execution Vulnerability (CVE-2022-4136)
5. threat[28811]:Liferay Portal Deserialization Vulnerability(CVE-2019-16891)
6. threat[28808]:WordPress Elementor Website Builder Plugin Remote Code Execution Vulnerability(CVE-2022-1329)
7. threat[28809]:Rukovoditel Cross-site Scripting Vulnerability(CVE-2022-44949)
8. threat[28810]:Wordpress Stock Ticker Plugin Cross-Site Scripting Vulnerability(CVE-2022-45365)
9. threat[28813]:Redash Default Hardcoding Vulnerability (CVE-2021-41192)
10. threat[28815]:Tinyproxy HTTP Connection Headers Use-After-Freevulnerability (CVE-2023-49606)
11. threat[28814]:Apple Products WebKit Component Buffer Error Vulnerability (CVE-2019-8684)
12. threat[32046]:WordPress plugin Elementor Website Cross-site Scripting Injection Vulnerability (CVE-2022-29455)
13. threat[28816]:Typecho install.php Deserialization Vulnerability
14. threat[28817]:Mozilla PDF.js Code Execution vulnerability (CVE-224-4367)
15. threat[28818]:ESAFENET Electronic Document Security Management System Injection Vulnerability(CVE-2025-1841)
16. threat[32052]:ESAFENET Electronic Document Security Management System SQL Injection Vulnerability(CVE-2024-10134)
17. threat[32051]:ESAFENET Electronic Document Security Management System SQL Injection Vulnerability(CVE-2024-10133)
18. threat[32050]:ESAFENET Electronic Document Security Management System SQL Injection Vulnerability(CVE-2024-10072)
19. threat[32049]:ESAFENET Electronic Document Security Management System SQL Injection Vulnerability(CVE-2024-10071)
20. threat[32048]:ESAFENET Electronic Document Security Management System SQL Injection Vulnerability(CVE-2024-10070)
21. threat[32047]:ESAFENET Electronic Document Security Management System SQL Injection Vulnerability(CVE-2024-10069)
22. threat[28819]:Weaver E-Office submit.php File Overwrite Vulnerability
23. threat[28820]:Weaver OA clusterupgrade Frontend File Upload Vulnerability
24. threat[32053]:Ivanti Endpoint Manager XML External Entity Injection Vulnerability (CVE-2024-37397)
25. threat[28821]:lollms-webui Arbitrary file upload Vulnerability(CVE-2024-9920)
26. threat[28822]:Yapi /api/interface/up has a NoSQL Injection Vulnerability
27. threat[28823]:NoSQL Injection Attack Behavior
28. threat[28827]:D-Link DIR-816L Improper Access Control Vulnerability(CVE-2022-28955)
29. threat[28826]:CData RSB Connect code issue vulnerability(CVE-2023-24243)
30. threat[28825]:CasaOS Authentication Bypass Vulnerability(CVE-2023-37265)
31. threat[28824]:Cacti Arbitrary File Creation Leads to Remote Code Execution Vulnerability(CVE-2025-24367)
32. threat[32054]:Apache Solr on Windows Path Discovery Vulnerability(CVE-2024-52012)
33. threat[28828]:CrushFTP Authentication Permission Bypass Vulnerability(CVE-2023-43177)
34. threat[28829]:Coremail Mail System Arbitrary File Upload Vulnerability
35. threat[28832]:Zhiyuan OA zip file upload govdocGBManager ofd background decompression Vulnerability
36. threat[32055]:Drawio Server Request Forgery Vulnerability (CVE-2022-1713)
37. threat[32056]:Drawio Server Request Forgery Vulnerability (CVE-2022-1815)
38. threat[28833]:Adobe ColdFusion WDDX Deserialization Gadgets (CVE-2023-44353)
39. threat[28830]:WordPress Bricks Builder 1.9.6 Remote Code Execution Vulnerability
40. threat[28831]:ZZCMS Cross-Site Scripting Vulnerability(CVE-2025-1949)
41. threat[10600]:Ivanti Connect Secure and Other Multi-Product Stack Overflow Vulnerability(CVE-2025-22457)
42. threat[32057]:Free5gc Information Leak Vulnerability _1(CVE-2022-38870)
43. threat[32058]:Free5gc Information Leak Vulnerability _2(CVE-2022-38870)
44. threat[32059]:Free5gc Information Leak Vulnerability_3(CVE-2022-38870)
45. threat[42402]:WordPress Plugin Analytics Insights for Google Open Redirect Vulnerability (CVE-2024-0250)
46. threat[28835]:Apache Commonscollections Deserialization Command Injection Vulnerability (CC9)
47. threat[32060]:HashiCorp Consul/Consul Enterprise Server-Side Request Forgery Vulnerability (CVE-2022-29153)
48. threat[32062]:Travelpayouts Redirection Vulnerability(CVE-2024-0337)
49. threat[32061]:WordPress Integrate Google Drive Plugin Missing Authorization Vulnerability(CVE-2023-32117)
50. threat[32063]:Terramaster TOS Permission License and Access Control Issues Vulnerability(CVE-2020-28185)
51. threat[28785]:Zoho ManageEngine ADSelfService Plus File Upload Vulnerability(CVE-2021-40539)
52. threat[32068]:WordPress plugin Active Directory Integration unauthenticated log leak (CVE-2023-5003)
53. threat[42415]:Suspected BloodHound Download
54. threat[28836]:Apache Commonscollections Deserialization Command Injection Vulnerability (K1/K2)
55. threat[32067]:WordPress PhonePe Payment Solutions Plugin Server-Side Request Forgery Vulnerability (CVE-2022-45835)
56. threat[28838]:Apache Commonscollections Deserialization Command Injection Vulnerability (K3/K4)
57. threat[42375]:sessionRAT Send Control Instruction
58. threat[42413]:XWiki Platform Open Redirect Vulnerability (CVE-2023-32068)
59. threat[32065]:XWiki Platform Information Disclosure Vulnerability (CVE-2023-50719)
60. threat[32064]:XWiki Platform Information Disclosure Vulnerability (CVE-2023-50720)
61. threat[32069]:SpringBoot Actuator heapdump Sensitive Information Leakage Vulnerability
62. threat[32071]:Windows Kerberos Security Feature Bypass Vulnerability(CVE-2025-29809)
63. threat[32073]:MeterSphere Server-Side Request Forgery Vulnerability (CVE-2022-23544)
64. threat[42376]:DarkVision RAT C2 Communication
65. threat[28840]:Digital Watchdog DW MEGApix IP Operating System Command Injection Vulnerability(CVE-2022-34540)
66. threat[28841]:Digital Watchdog DW MEGApix IP Operating System Command Injection Vulnerability(CVE-2022-34539)
67. threat[28842]:Digital Watchdog DW MEGApix IP Operating System Command Injection Vulnerability(CVE-2022-34538)
68. threat[28843]:Langflow Remote Code Execution Vulnerability(CVE-2025-3248)
69. threat[28844]:D-Link DNS-320 Network Command Injection Vulnerability(CVE-2019-16057)
70. threat[32072]:SpringBlade Default SIGN_KRY JWT Authentication Flaw Vulnerability(CVE-2021-44910)
71. threat[32074]:Microweber Information Disclosure Vulnerability (CVE-2022-0660)
72. threat[32075]:WAVLINK WN530HG4 Information Disclosure Vulnerability (CVE-2022-34045)
73. threat[32076]:WAVLINK WN533A8 Information Disclosure Vulnerability (CVE-2022-34046)
74. threat[32077]:Keystone 6 Login Page Open Redirect Vulnerability(CVE-2022-0087)
75. threat[32078]:Lin CMS Spring Boot Default JWT Token Vulnerability(CVE-2022-32430)
76. threat[32079]:Login as User or Customer Privilege Escalation Vulnerability(CVE-2022-4305)
77. threat[32080]:Masa CMS Authentication Bypass Vulnerability (CVE-2022-47002)
update rules:
1. threat[24840]:jboss deserialization vulnerability(CVE-2017-7504)
2. threat[42375]:sessionRAT Send Control Instruction
3. threat[42376]:DarkVision RAT C2 Communication
4. threat[25475]:Apache Log4j2 Remote Code Execution Vulnerability(CVE-2021-44228/CVE-2021-45046)
5. threat[31478]:Wordpress Plugin Superstorefinder SQL Injection Vulnerability
6. threat[26957]:Gopher Protocol - Server Side Request Forgery(SSRF)
7. threat[25577]:Oracle Access Manager OpenSSO Agent Insecure Deserialization(CVE-2021-35587)
8. threat[28686]:Ollama Improperly Configured Unauthorized Access Vulnerability (CNVD-2025-04094)
9. threat[26148]:Fastjson 1.2.47 Deserialization Vulnerability(CNVD-2019-22238)
10. threat[26149]:Fastjson 1.2.62 Deserialization Vulnerability
11. threat[26140]:Fastjson 1.2.24 Deserialization Vulnerability(CNVD-2017-02833)
12. threat[26144]:Fastjson 1.2.41 Deserialization Vulnerability
13. threat[26145]:Fastjson 1.2.42 Deserialization Vulnerability
14. threat[26146]:Fastjson 1.2.43 Deserialization Vulnerability
15. threat[26147]:Fastjson 1.2.45 Deserialization Vulnerability
16. threat[26151]:Fastjson 1.2.66 Deserialization Vulnerability
17. threat[26153]:Fastjson 1.2.68 Deserialization Vulnerability
18. threat[27981]:Weaver OA e-cology Action.jsp MobileAppUploadAction File Upload Vulnerability
19. threat[42044]:Suspected PHP file inclusion using pseudo-protocols in request parameters
20. threat[25910]:Apache CommonsCollections Deserialization Command Injection Vulnerability (CC2)
21. threat[25921]:Apache CommonsBeanutils Deserialization Command Injection Vulnerability (CB1)
22. threat[23426]:Allegro Software RomPager 'Fortune Cookie' Unspecified HTTP Authentication Bypass (CVE-2014-9222)
23. threat[25909]:Apache CommonsCollections Deserialization Command Injection Vulnerability (CC1)
24. threat[25911]:Apache CommonsCollections Deserialization Command Injection Vulnerability (CC3)
25. threat[25912]:Apache CommonsCollections Deserialization Command Injection Vulnerability (CC4)
26. threat[25913]:Apache CommonsCollections Deserialization Command Injection Vulnerability (CC5)
27. threat[27427]:Yonyou U9 PatchFile.asmx Arbitrary File Upload Vulnerability
28. threat[25397]:Adobe ColdFusion Deserialization Vulnerability(CVE-2017-3066)
29. threat[30865]:Spring Boot Actuator Endpoint Unauthorized Access to Sensitive Information Vulnerability
30. threat[30814]:E-offcie mysql_config.ini Information Disclosure Vulnerability
31. threat[31133]:Apache Solr Environment Variable Information Disclosure Vulnerability(CVE-2023-50290)
32. threat[25914]:Apache CommonsCollections Deserialization Command Injection Vulnerability (CC6)
33. threat[25915]:Apache CommonsCollections Deserialization Command Injection Vulnerability (CC7)
34. threat[28645]:Discover the ShiroAttack2 Tool Memory Injection Behavior
35. threat[26192]:Apache CommonsCollections Deserialization Command Injection Vulnerability (CC8)
36. threat[28785]:Zoho ManageEngine ADSelfService Plus File Upload Vulnerability(CVE-2021-40539)
37. threat[50083]:RDP Remote Desktop Protocol Service Terminal Service User Login Attempt
38. threat[24309]:Apache ActiveMQ Fileserver File Upload Directory Traversal Vulnerability(CVE-2016-3088)
39. threat[28735]:Metasploit Meterpreter linux/x64/meterpreter_reverse_http Trojan Connection Attempts
40. threat[28668]:XWiki Platform Remote Code Execution Vulnerability(CVE-2025-24893)
41. threat[26359]:Landray OA sysUiExtend file upload vulnerability
42. threat[27423]:Laravel ser Deserialisation Command Execution Vulnerability(CNVD-2022-44351)
43. threat[41708]:Host in an AD Domain Enumerate Domain Users Information
44. threat[60993]:HTTP Cross Site Generic Scripting Attempt
45. threat[25945]:Spring Deserialization Code Injection Vulnerability
46. threat[23277]:Web Service Cross-Site Scripting
47. threat[24469]:Oracle WebLogic wls9-async Component Deserialization RCE Vulnerability(CVE-2019-2725/CVE-2019-2729)
48. threat[28228]:Apache Airflow Unauthorized Access Vulnerability (CVE-2020-13927)
49. threat[24286]:WebLogic Arbitrary File Upload Remote Code Execution Vulnerability(CVE-2018-2894)
50. threat[26448]:Oracle WebLogic Server Deserialization Vulnerability (CVE-2019-2725)
51. threat[31831]:Windows Kerberos Security Feature Bypass Vulnerability(CVE-2025-21299)
52. threat[24207]:Oracle WebLogic Server Remote Code Execution Vulnerability（CVE-2017-10271/CVE-2017-3506）
53. threat[25170]:Apache Druid Remote Code Execution Vulnerability(CVE-2021-25646)
54. threat[27931]:SOURCEFORGE Adminer Server Request Forgery SSRF Vulnerability (CVE-2021-21311)
55. threat[26276]:Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability (CVE-2023-35078)
56. threat[25930]:Oracle E-Business Suite Unauthenticated RCE(CVE-2022-21587)
Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the Zealot 2.0 intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.39682. The new/improved rules of this upgrade package are:
new rules:
1. threat[42389]:VenomRAT TCP Communication
2. threat[32021]:Open-webui prompt_tokens Stored Cross-Site Scripting Vulnerability(CVE-2024-8017)
3. threat[28771]:CrushFTP Authentication Bypass Vulnerability (CVE-2025-2825)
4. threat[28806]:pgAdmin Remote Code Execution Vulnerability (CVE-2025-2945)_2
5. threat[42377]:Zloader Trojan C2 Communication
6. threat[32022]:SpringCloud Eureka Unauthorized Access Vulnerability
7. threat[28773]:OctoberCMS Remote Code Execution Vulnerability (CVE-2022-21705)
8. threat[28772]:SpringBoot Actor SnakeYAML Remote Command Execution Vulnerability
9. threat[42378]:JanelaRAT C2 Check-in
10. threat[32043]:QNAP Systems Photo Station Path Traversal Vulnerability(CVE-2019-7195)
11. threat[42380]:SystemBC Trojan C2 Communication
12. threat[42381]:Chaos Backdoor TCP Traffic Signaling
13. threat[42382]:Panora Backdoor HTTP Traffic Signaling
14. threat[42383]:SILENTTRINITY C2 Communication
15. threat[28774]:SharePonit Remote Code Execution Vulnerability (CVE-2020-1181)
16. threat[32023]:YesWiki Path Traversal Vulnerability(CVE-2025-31131)
17. threat[32024]:WordPress plugin WP01 path traversal vulnerability(CVE-2025-30567)
18. threat[28777]:HashiCorp Consul Service API Remote Command Execution Vulnerability
19. threat[28778]:XML External Entity Injection (XXE)-(URL Encoding)
20. threat[32028]:WSO2 Multi-Product Cross-Site Scripting Injection Vulnerability (CVE-2022-29548)
21. threat[32029]:Vite Any File Read Vulnerability (CVE-2025-31486)
22. threat[28775]:Hanta Technology Internet Behavior Management System cappkt.php Command Injection Vulnerability
23. threat[28776]:Hanta Technology Internet Behavior Management System tracert.php Command Injection Vulnerability
24. threat[32025]:YonYou NC viewPsnCard/download SQL Injection Vulnerability
25. threat[32026]:YonYou NC portalpage/importPml SQL Injection Vulnerability
26. threat[32027]:YonYou NC pkevalset SQL Injection Vulnerability
27. threat[42384]:Tular APT Penquin Trojan UDP Traffic Signaling
28. threat[32030]:Red Hat Keycloak Server Request Forgery Vulnerability (CVE-2020-10770)
29. threat[42385]:APT29 CobaltStrike Online
30. threat[32031]:Zabbix CApiService.php SQL Injection Vulnerability(CVE-2024-36465)
31. threat[28779]:Tenda Router uploadWewifiPic Background RCE Vulnerability
32. threat[28780]:TongWeb /console/service Remote Code Execution Vulnerability
33. threat[28781]:QVIS NVR Camera Management System Deserialization Arbitrary Code Execution Vulnerability (CVE-2021-41419)
34. threat[42386]:SquidLoader CobaltStrike C2 Request
35. threat[42387]:SquidLoader CobaltStrike C2 Communication
36. threat[28782]:Zyxel USG/ZyWALL Authorization Issue Vulnerability(CVE-2022-0342)
37. threat[28783]:Zoho ManageEngine SAML Arbitrary Code Execution Vulnerability (CVE-2022-47966)
38. threat[32032]:TP-Link TL-R600VPN Directory Traversal Vulnerability (CVE-2018-3949)
39. threat[28784]:Royal Event Management System SQL Injection Vulnerability (CVE-2022-28080)
40. threat[42369]:Suspected FRP Intranet Penetration Tool QUIC Communication
41. threat[32033]:Wordpress Website File Changes Monitor Plugin SQL Injection Vulnerability (CVE-2022-2269)
42. threat[28786]:VMware Workspace ONE Access OAuth2 Bypass Authentication Bypass Leads To Remote Command Execution Vulnerability(CVE-2022-22955)
43. threat[28805]:Western Digital MyCloud NAS Command Injection Vulnerability(CVE-2016-10108)
44. threat[10598]:open-webui pdf Denial of Service (DoS) Vulnerability(CVE-2024-8053)
45. threat[28788]:Zabbix 5.0.17 Remote Code Execution Vulnerability
46. threat[32034]:School Dormitory Management System Cross-Site Script Injection Vulnerability (CVE-2022-30513)
47. threat[32035]:School Dormitory Management System Cross-Site Script Injection Vulnerability (CVE-2022-30514)
48. threat[28789]:Zabbix setup.php path has an authentication bypass vulnerability(CVE-2022-23134)
49. threat[32036]:ESAFENET Electronic Document Security Management System SQL Injection Vulnerability(CVE-2025-1158)
50. threat[32037]:WordPress plugin Yawave SQL injection vulnerability(CVE-2025-1648)
51. threat[28790]:Tenda FH1201 Overflow Vulnerability(CVE-2024-41463)
52. threat[28791]:Tenda Buffer Overflow Vulnerability(CVE-2024-41464)
53. threat[28792]:Tenda Buffer Overflow Vulnerability(CVE-2024-41460)
54. threat[28793]:Tenda QuickIndex Buffer Overflow Vulnerability(CVE-2024-2989/CVE-2024-3007/CVE-2024-34943/CVE-2024-41466)
55. threat[28794]:Tenda DhcpListClient Buffer Overflow Vulnerability(CVE-2024-41462/CVE-2024-3910/CVE-2024-34946/CVE-2022-46548/CVE-2024-2814)
56. threat[28795]:Tenda DhcpListClient Buffer Overflow Vulnerability(CVE-2024-34944/CVE-2024-41461)
57. threat[28796]:D-Link set_prohibiting command injection vulnerability(CVE-2025-29635)
58. threat[28797]:D-Link diag_nslookup Command Injection Vulnerability(CVE-2025-2717)
59. threat[42388]:Mythic C2 Framework Online
60. threat[10599]:open-webui format Denial of Service (DoS) Vulnerability(CVE-2024-12537)
61. threat[32040]:Ignite Realtime Openfire Server Request Forgery Vulnerability (CVE-2019-18394)
62. threat[32041]:Zhiyuan Internet FE Collaborative Office Platform addUser.jsp SQL Injection Vulnerability(CVE-2025-2030)
63. threat[28803]:Zhongbang Technology CRMEB Open Source E-Commerce System Java XXE Vulnerability (CVE-2025-2365)
64. threat[32039]:WordPress WooCommerce Plugin Local File Inclusion Vulnerability(CVE-2025-1661)
65. threat[28801]:Apache Camel Arbitrary Command Execution Vulnerability(CVE-2025-27636)
66. threat[28800]:Apache Camel Arbitrary Command Execution Vulnerability(CVE-2025-29891)
67. threat[28799]:JSONPath Plus Security Vulnerability(CVE-2025-1302)
68. threat[32038]:ChurchCRM System EditEventTypes.php newCountName Parameter SQL Injection Vulnerability(CVE-2025-1023)
69. threat[28798]:Shenzhou Digital DCME-520 mon_merge_stat_hist.php Command Injection Vulnerability(CVE-2025-3002)
70. threat[32042]:WordPress Updraftplus Plugin XSS Vulnerability
71. threat[28804]:lollms-webui upload_app Arbitrary File Delete Vulnerability(CVE-2024-8581)
72. threat[28802]:pgAdmin Remote Code Execution Vulnerability (CVE-2025-2945)

update rules:
1. threat[42204]:Sliver Infiltration Attack Tool Beacon Connection _2
2. threat[42322]:Crimson RAT info Command Obtains System Information
3. threat[42323]:Crimson RAT getavs Command Obtains Process Information
4. threat[28735]:Metasploit Meterpreter linux/x64/meterpreter_reverse_http Trojan Connection Attempts
5. threat[28738]:kkFileView onlinePreview Cross-Site Scripting Vulnerability(CVE-2022-29349/CVE-2022-40879)
6. threat[28739]:kkFileView picturesPreview Cross-Site Scripting Vulnerability(CVE-2022-35151/CVE-2022-46934)
7. threat[25549]:Spring Boot Eureka XStream Deserializable Remote Code Execution Vulnerability
8. threat[27823]:Apache OFBiz Remote Code Execution Vulnerability (CVE-2024-38856)
9. threat[24302]:Suspicious XML External Entity(XXE) Injection Attempt
10. threat[24779]:Horde Groupware Webmail Edition 5.2.22 Remote Code Execution Vulnerability (CVE-2020-8518)
11. threat[28205]:Harbor Permission Permission And Access Control Issue Vulnerability (CVE-2019-16097)
12. threat[50652]:XML External Entity Injection (XXE)-(HTML Entity Encoding/UTF-16/UTF-7)
13. threat[31292]:Jquery FileTree Path Traversal Vulnerability (CVE-2017-1000170)
14. threat[24154]:Intel Active Management Technology Remote Privilege Escalation Vulnerability(CVE-2017-5689)
15. threat[25930]:Oracle E-Business Suite Unauthenticated RCE(CVE-2022-21587)
16. threat[28183]:Maccms 8.X Index.Php Vod-Search Command Execution Vulnerability (CVE-2017-17733)
17. threat[26296]: TOTOLINK setUpgradeFW Command Injection Vulnerability (CVE-2022-28494/CVE-2022-26210)
18. threat[24263]:Apache Hadoop YARN ResourceManager Remote Command Execution Vulnerability
19. threat[60471]:HTTP Directory Traversal Access /etc/passwd
20. threat[24868]:TP-LINK Cloud Cameras NCXXX Bonjour Command Injection(CVE-2020-12109)
21. threat[30951]:WeChat Work Privatized Version agentinfo interface unauthorized vulnerability
22. threat[26840]:ZOHO ManageEngine Password Manager Pro Deserialization Vulnerability (CVE-2022-35405)
23. threat[26969]:ZOHO ManageEngine Desktop Central MSP Authorization Vulnerability (CVE-2021-44515)
24. threat[42371]:Remcos RAT TCP Communication
25. threat[31301]:QNAP Systems QTS and QuTS hero SQL Injection Vulnerability (CVE-2022-27596)
26. threat[31357]:Wordpress Wp-Google-Maps Plugin SQL Injection Vulnerability(CVE-2019-10692)
27. threat[31348]:VICIdial Information Disclosure Vulnerability (CVE-2021-28854)
28. threat[31495]:Oracle E-Business Suite /OA_HTML/jtfwrepo.xml Sensitive Information Leakage Vulnerability
29. threat[26557]:Smartbi token Callback To Obtain Login Credentials Vulnerability
30. threat[27649]:Tenda QuickIndex Stack Overflow Vulnerability (CVE-2022-37815/CVE-2024-0922/CVE-2024-2486/CVE-2024-2808/CVE-2024-2891/CVE-2024-2977/CVE-2024-2985/CVE-2024-2993/CVE-2024-3011/CVE-2024-3906/CVE-2024-30636)
31. threat[25746]:Linux Information Collection Command Execution (Request Parameters)
32. threat[27320]:Palo Alto Networks PAN-OS Command Injection Vulnerability (CVE-2021-3060/CVE-2019-1579)
33. threat[42104]:XXL-JOB Default accesstoken vulnerability
34. threat[42204]:Sliver Infiltration Attack Tool Beacon Connection _2


Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the Zealot 2.0 intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.39524. The new/improved rules of this upgrade package are:

new rules:
1. threat[42371]:Remcos RAT TCP Communication
2. threat[28766]:ThinkPHP 6.0.12 Deserialization Arbitrary Code Execution Vulnerability (CVE-2022-33107)
3. threat[42372]:AsyncRAT Loader Connection Request
4. threat[32020]:Vite Any File Read Vulnerability (CVE-2025-31125)
5. threat[28767]:open-webui doc Arbitrary file Upload Vulnerability(CVE-2024-6707)
6. threat[28768]:Dell EMC iDRAC7 and iDRAC8 Code Injection Vulnerability (CVE-2018-1207)
7. threat[32015]:RAGFlow document Unauthorized Access Vulnerability(CVE-2024-53450)
8. threat[32016]:Purple File Management System editPass SQL Injection Vulnerability
9. threat[28769]:Purple File Management System WorkFlow Arbitrary File Upload Vulnerability
10. threat[28770]:RAGFlow add_llm Remote code execution Vulnerability(CVE-2024-10131)
11. threat[32018]:Argus Surveillance DVR Directory Traversal Vulnerability (CVE-2018-15745)
12. threat[32019]:Fastjson 1.2.73 - 1.2.80 Arbitrary File Read Vulnerability
13. threat[42373]:SilverFox Trojan Aes encrypted communication
14. threat[32017]:ActiveUC iactiveEnterMeeting Information Leakage Vulnerability
15. threat[10597]:open-webui markdown Denial of Service (DoS) Vulnerability(CVE-2024-7983)
16. threat[42374]:Workviner Trojan DHT CommunicationAnnouncements:

update rules:
1. threat[31846]:Purple eRecords Management System Login Information Disclosure Vulnerability
2. threat[23811]:Apache APR_PSPrintf Memory Corruption Vulnerability
3. threat[41499]:HTTP Request Sensitive Path Access Attempt
4. threat[28764]:Kubernetes ingress-nginx Remote Code Execution Vulnerability (CVE-2025-1974)
5. threat[28632]:Microsoft .NET Framework DataSetTypeSpoof Deserialization Arbitrary Command Execution Vulnerability
6. threat[23991]:Fastjson Remote Code Execution Vulnerability
7. threat[25704]:Apache Commons JXPath Remote Code Execution Vulnerability(CVE-2022-41852)
8. threat[27119]:Apache Zeppelin shell Arbitrary Command Execution Vulnerability (CVE-2024-31861)
9. threat[24862]:SaltStack Remote Command Execution Vulnerability(CVE-2020-11651/CVE-2020-11652)
10. threat[28686]:Ollama Improperly Configured Unauthorized Access Vulnerability (CNVD-2025-04094)
11. threat[28736]:Rsync Unauthorized Access Vulnerability
12. threat[30865]:Spring Boot Actuator Endpoint Unauthorized Access to Sensitive Information Vulnerability
13. threat[28447]:HTTP Python Code Execution Type Two
14. threat[42226]:BITTER Steal Files With Specific Extensions
15. threat[42099]:Empire Rear Penetration Tool Backdoor Communication 2
16. threat[42134]:Bitter-SplinterRAT Malicious Communication
17. threat[27219]:Jeecg-boot SQL Injection Vulnerability (CVE-2022-47105/CVE-2022-45205)
18. threat[42106]:Njrat C2 Agent Transmission

Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the Zealot 2.0 intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.39457. The new/improved rules of this upgrade package are:

new rules:
1. threat[42367]:OceanLotus Uses MST To Deliver Remote Trojan
2. threat[10596]:5G Infrastructure GTP-U In GTP-U Denial Of Service Vulnerability
3. threat[42368]:OceanLotus KSRAT RAT C2 Communication
4. threat[32013]:open-webui embedding/update Information Leakage Vulnerability(CVE-2024-7038)
5. threat[28763]:open-webui pipelines/upload Arbitrary file write/delete Vulnerability(CVE-2024-7037)
6. threat[42370]:OceanLotus Uses Cobalt Strike MASK Encryption Communication
7. threat[28764]:Kubernetes ingress-nginx Remote Code Execution Vulnerability (CVE-2025-1974)
8. threat[28765]:open-webui transcriptions Arbitrary file overwriting Vulnerability(CVE-2024-8060)

update rules:
1. threat[60464]:HTTP Directory Traversal Vulnerability
2. threat[62105]:HTTP Directory Traversal Request Attempt
3. threat[24309]:Apache ActiveMQ Fileserver File Upload Directory Traversal Vulnerability(CVE-2016-3088)
4. threat[26153]:Fastjson 1.2.68 Deserialization Vulnerability
5. threat[41499]:HTTP Request Sensitive Path Access Attempt
6. threat[30913]:Volans Online Behavior Management System Information Disclosure Vulnerability
7. threat[28299]:AntSword Webshell Management Tool Connection and Control_3

Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the Zealot 2.0 intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.39421. The new/improved rules of this upgrade package are:


new rules:
1. threat[31988]:SMTP Protocol SQL Injection Behavior
2. threat[31999]:Weaver E-office runimgflow.php SQL Injection Vulnerability
3. threat[31998]:Weaver E-office notify.wsdl.php SQL Injection Vulnerability
4. threat[31997]:Wanhue zOFFICE selectCommentField.jsp SQL Injection Vulnerability
5. threat[31996]:Weaver E-office sms.wsdl.php SQL Injection Vulnerability
6. threat[31995]:Weaver E-office user.wsdl.php SQL Injection Vulnerability
7. threat[31994]:Weaver E-office mobile.wsdl.php SQL Injection Vulnerability
8. threat[31993]:Weaver E-office list.wsdl.php SQL Injection Vulnerability
9. threat[31992]:Weaver E-office dept.wsdl.php SQL Injection Vulnerability
10. threat[31991]:Weaver E-office email.wsdl.php SQL Injection Vulnerability
11. threat[31990]:EKing-Management Easy FileDownload.ihtm Arbitrary File Reading Vulnerability
12. threat[42365]:Patchwork APT BADNEWS Trojan C2 Communication
13. threat[28758]:College Management System SQL Injection Vulnerability (CVE-2022-28079)
14. threat[32000]:Weaver E-office freerunimgflow.php SQL Injection Vulnerability
15. threat[32001]:Weaver E-office word_update.php SQL Injection Vulnerability
16. threat[32002]:Weaver E-office block_content.php SQL Injection Vulnerability
17. threat[32003]:Weaver E-office content_-4.php SQL Injection Vulnerability
18. threat[32004]:Weaver E-office validate_sort.php SQL Injection Vulnerability
19. threat[32005]:Weaver E-office online_person.wsdl.php SQL Injection Vulnerability
20. threat[32006]:Weaver E-office attendance.wsdl.php SQL Injection Vulnerability
21. threat[28759]:SolarWinds Web Help Desk Hard-Coded Vulnerability(CVE-2024-28987)
22. threat[32007]:Yonyou U8 Cloud console.loadRes.d Arbitrary File Read Vulnerability
23. threat[28756]:FortiOS/FortiProxy Authentication Bypass Vulnerability (CVE-2024-55591)
24. threat[31989]:litellm transcriptions Arbitrary file delete Vulnerability(CVE-2024-4888)
25. threat[42366]:SideWinder APT ModuleInstaller Sample C2 Communication
26. threat[28761]:litellm update SQL Injection Vulnerability(CVE-2024-4890)
27. threat[32011]:Baiyi Cloud Asset Management System anyUserBoundHouse.php SQL Injection Vulnerability(CVE-2025-1797)
28. threat[32010]:Landray EKP sys/webservice/elecPsealUseWebService file reading vulnerability
29. threat[32009]:Baiyi Cloud Asset Management System admin.house.collect.php SQL Injection Vulnerability(CVE-2025-1464)
30. threat[28760]:Synway SMG Gateway Management Software 9-12ping.php Remote Code Execution Vulnerability (CVE-2025-1448)
31. threat[32008]:Landray EKP System fl_define_edit.aspx SQL Injection Vulnerability
32. threat[28762]:litellm SAVE_CONFIG_TO_DB Remote Code Execution Vulnerability(CVE-2024-4889)
33. threat[28757]:Yonyou NC importTemplate XML Entity Injection Vulnerability
34. threat[42343]:Merlin Communication with the C2 servers

update rules:
1. threat[24840]:jboss deserialization vulnerability(CVE-2017-7504)
2. threat[28754]:Backdrop CMS Cross-Site Scripting Vulnerability (CVE-2022-42094/CVE-2022-42096)
3. threat[25035]:Coremail XT5 Remote Code Execution Vulnerability
4. threat[31890]:Apache HTTP Server Server Request Forgery Vulnerability (CVE-2024-38472)

Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the Zealot 2.0 intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.39379. The new/improved rules of this upgrade package are:

new rules:
1. Attack [26938]: Microsoft SharePoint Server Web Remote Code Execution Vulnerability (CVE-2020-1181)
2. Attack [31984]: Open Audit Community Cross Site Script Injection Vulnerability (CVE8-14493)
3. Attack [31985]: Alibaba Canal config Cloud Key Sensitive Information Leakage Vulnerability
4. Attack [28752]: QAnything delete_files SQL injection vulnerability (CVE-2024-7099)
5. Attack [42363]: Platypus TCP communication
6. Attack [31986]: Supplemental Razdc WebUI Cross Site Script Injection Vulnerability (CVE8-15550)
7. Attack [42364]: NPS HTTP intranet proxy connection_2
8. Attack [28753]: Apache Tika tika server command injection vulnerability (CVE8-1335) _2
9. Attack [25982]: Pentaho Unauthorized Access Vulnerability (CVE-2021-31602)
10. Attack [28754]: Backdrop CMS Cross Site scripting vulnerability (CVE-222-42094)
11. Attack [28755]: NextJS Middleware authentication bypass vulnerability (CVE-225-29927)
12. Attack [31987]: Comfyui image cross site scripting vulnerability (CVE-224-10099)

update rules:
1. threat[26835]:Ruiqiyun Arbitrary File Reading Vulnerability
2. threat[42039]:Immortal Soul Webshell Upload
3. threat[63682]:HTTP SQL Injection Attempt Type Three
4. threat[25021]:Apache DolphinScheduler Remote Code Execution Vulnerability(CVE-2020-11974)
5. threat[42149]:SSRF Pseudo-Protocol Attacks Exist In Suspected Request Parameters
6. threat[42147]:HTTP Sensitive Parameters Execute Arbitrary Command Attempt
7. threat[23426]:Allegro Software RomPager 'Fortune Cookie' Unspecified HTTP Authentication Bypass (CVE-2014-9222)
8. threat[24302]:Suspicious XML External Entity(XXE) Injection Attempt
9. threat[25303]:Apache Cocoon XML External Entity Injection Vulnerability (CVE-2020-11991)
10. threat[24577]:Atlassian Confluence Server PackageResourceManager Information Disclosure Vulnerability(CVE-2019-3394)
11. threat[25715]:Atlassian Confluence Questions Hardcoded Password Vulnerability(CVE-2022-26138)
12. threat[25182]:nps http proxy connection

Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade

This upgrade package is the Zealot 2.0 intrusion protection signature library/application identification signature library upgrade package, which only supports engine version V56R11F01 and above. The upgrade package is a full upgrade package. After the upgrade, the firmware version and engine version remain unchanged, and the rule version becomes 2.0.0.39338. The new/improved rules of this upgrade package are:

new rules:
1. threat[27749]:Qunjie seal IoT Management Platform Password Reset Behavior
2. threat[28709]:H2O-3 Parse Arbitrary File Overwrite Vulnerability(CVE-2024-5986)
3. threat[41590]:phpMyAdmin User Password Brute Force Attack
4. threat[31981]:DedeCMS update_guide.php path traversal Vulnerability(CVE-2024-3686)
5. threat[28711]:ShiKongZhiYou ERP system uploadStudioFile File Upload Vulnerability
6. threat[28712]:Baiyi Cloud Asset Management System admin.ticket.close.php SQL Injection Vulnerability
7. threat[31980]:Huang Yaoshi Pharmaceutical Management Software XSDService.asmx SQL Injection Vulnerability
8. threat[28708]:WordPress GDPR Plugin Cross-site Scripting Vulnerability(CVE-2022-0220)
9. threat[31955]:WordPress Fontsy Plugin SQL Injection Vulnerability(CVE-2022-4447)
10. threat[28710]:WordPress Embed Swagger Plugin Cross-site Scripting Vulnerability(CVE-2022-0381)
11. threat[28713]:ZZCMS system interface ad_list.php SQL injection vulnerability (CVE-2024-11242)
12. threat[31956]:Thermal Network Wireless Monitoring System frmSaveChartImage Arbitrary File Reading Vulnerability
13. threat[31957]:CanXingYun Digital Catering Service System Information Leakage Vulnerabilities
14. threat[28714]:JEEWMS dynamicDataSourceController.do JDBC Deserialization Vulnerability
15. threat[28715]:Vllm pickle Deserialization Vulnerability(CVE-2024-9052)
16. threat[28734]:Hadoop YARN REST API Unauthorized Access Vulnerability
17. threat[31978]:Netgear WN604 siteSurvey.php Unauthorized Access Vulnerability(CVE-2024-7153)
18. threat[31979]:Mankebao Smart Canteen System selectUserByOrgId Unauthorized Access Vulnerability
19. threat[28716]:FlowiseAI Flowise Arbitrary File Upload Vulnerability(CVE-2025-26319)
20. threat[31958]:ChangJieTong T+ Getdecallusers Interface Sensitive Information Leakage Vulnerability
21. threat[31960]:MyBB New Threads Plugin Cross-Site Scripting Vulnerability (CVE-2018-14392)
22. threat[31959]:Dahua Intelligent Internet Of Things Integrated Management Platform Personinfo Information Leakage Vulnerability
23. threat[28717]:Vllm MessageQueue pickle Deserialization Vulnerability(CVE-2024-11041)
24. threat[42311]:APT37 RokRat Trojan C2 Communication
25. threat[42312]:Cobalt Strike TaoWu Reverse HTTP C2 Communication
26. threat[28720]:PrestaShop SQL Injection Vulnerability (CVE-2023-45375)
27. threat[31966]:Streamlit directory traversal vulnerability(CVE-2022-35918)
28. threat[28719]:FUEL CMS Remote Code Execution Vulnerability(CVE-2018-16763)
29. threat[28721]:FUEL CMS /preview Remote Code Execution Vulnerability
30. threat[31967]:FUEL CMS /pages/items SQL Injection Vulnerability
31. threat[28722]:litellm update Remote Code Execution Vulnerability(CVE-2024-4264)
32. threat[42313]:Ant-Sword Webshell Trojan Upload (php_assert_script)
33. threat[42314]:Ant-Sword Webshell Trojan Upload (php_create_function_script)
34. threat[28723]:litellm api_key SQL Injection Vulnerability(CVE-2024-5225)
35. threat[42315]:Ant-Sword Webshell Trojan Upload (php_custom_script_for_mysql)
36. threat[28724]:ImageMagick Arbitrary File Read Vulnerability (CVE-2022-44268) _2
37. threat[42316]:Ant-Sword Webshell Trojan Upload (php_eval_rsa_script)
38. threat[42317]:Ant-Sword Webshell Trojan Upload(asp_eval_xxxx_script)
39. threat[31969]:Yonyou U9 Interface TransWebService Unauthorized Access Vulnerability
40. threat[31961]:Anmei Digital Hotel Broadband Operation System(HiBOS) get_user_enrollment.php SQL injection vulnerability
41. threat[31962]:Anmei Digital Hotel Broadband Operation System(HiBOS) get_ip.php SQL injection vulnerability
42. threat[31963]:Anmei Digital Hotel Broadband Operation System(HiBOS) list_qry.php SQL injection vulnerability
43. threat[31964]:WordPress Plugin Icegram-Express Unauthenticated SQL Injection Vulnerability(CVE-2024-4295)
44. threat[28718]:WordPress plugin radio SSRF vulnerability(CVE-2024-54385)
45. threat[31965]:WordPress plugin WP-Guru arbitrary file read vulnerability(CVE-2024-12849)
46. threat[31968]:Wanhu OA Unauthorized Access Vulnerability
47. threat[42318]:Ant-Sword Webshell Trojan Upload(asp.net_custom_script_for_odbc)
48. threat[42319]:Ant-Sword Webshell Trojan Upload (asp.net_eval_script)
49. threat[28725]:litellm Remote Code Execution Vulnerability(CVE-2024-5751)
50. threat[28727]:Edimax IC-7100 IP Camera Command Inject Vulnerability(CVE-2025-1316)
51. threat[28726]:Cacti Remote Code Execution Vulnerability (CVE-2024-25641)
52. threat[31970]:Zhongke Zhiyuan Technology Comprehensive Supervision Cloud Platform Camera Information Leakage Vulnerability
53. threat[31971]:ActiveMQ Information Disclosure Vulnerability(CVE-2017-15709)
54. threat[42320]:Antsword Webshell Trojan Upload (jsp_custom_script_for_mysql/oracle)
55. threat[28728]:Apache Solr Unauthorized Access Vulnerability
56. threat[31973]:Casbin get-users Account Password Leakage Vulnerability
57. threat[42321]:Antsword Webshell Trojan Upload (jsp_defineclass_script)
58. threat[31974]:Anwang Intelligent AC Management System Information Disclosure Vulnerability
59. threat[28730]:Glodon OA GetSSOStamp Interface Arbitrary User Login Vulnerability
60. threat[42324]:Ant-Sword Webshell Trojan Upload (jsp_defineclass_zlib_deflated_script)
61. threat[42322]:Crimson RAT info Command Obtains System Information
62. threat[42323]:Crimson RAT getavs Command Obtains Process Information
63. threat[28729]:Apache Spark Unauthorized Access Vulnerability
64. threat[42326]:AllaKore RAT Communication
65. threat[42325]:FRP Websocket Default Communication Behavior
66. threat[42327]:Hancitor Malware C2 Communication
67. threat[42328]:Intranet Tunneling Tool Pivotnacci Connection Behavior_2
68. threat[28731]:Go-fastdfs GetClientIp Unauthorized Access Vulnerability
69. threat[28732]:Digiton Cloud Platform Cookie Login Bypass Vulnerability
70. threat[50669]:DockerUI Default Password Login Attempts
71. threat[28735]:Metasploit Meterpreter linux/x64/meterpreter_reverse_http Trojan Connection Attempts
72. threat[42329]:HTTP request headers carry suspected command injection payloads
73. threat[28733]:Spring Web UriComponents Builder URL Resolution Inappropriate Vulnerability (CVE-224-22243/CVE-2024-22259)
74. threat[31975]:Nacos configs Unauthorized download of configuration information
75. threat[31977]:Ruisconda Wireless Controller main.asp Unauthorized Access Vulnerability
76. threat[42331]:Raccoon Stealer C2 Communication
77. threat[28736]:Rsync Unauthorized Access Vulnerability
78. threat[31976]:Memcached Information Disclosure Vulnerability
79. threat[28751]:Python Tornado template injection in suspected request parameters
80. threat[28742]:Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-28482)
81. threat[28743]:Apache DolphinScheduler Arbitrary User Password Modification Vulnerability (CVE-2020-13922)
82. threat[28744]:Digital China Cloud DCME-520 Command Execution Vulnerability (CNVD-2021-47186)
83. threat[28745]:OneBlog Blog Shiro Deserializes Remote Command Execution Vulnerability
84. threat[28741]:Beijing Shenzhou Triage Calling System doctor Arbitrary File Upload Vulnerability
85. threat[31982]:Cloud Spacetime Socialized Business ERP System User/Online Identity Authentication Bypass Vulnerability
86. threat[28746]:ESAFENET logincontroller Remote Command Execution Vulnerability
87. threat[28747]:Laike E-Commerce Management System t_comment File Upload Vulnerability
88. threat[28738]:kkFileView onlinePreview Cross-Site Scripting Vulnerability(CVE-2022-29349)
89. threat[28739]:kkFileView picturesPreview Cross-Site Scripting Vulnerability(CVE-2022-35151)
90. threat[28740]:Aruba ClearPass Policy Manager Remote Code Execution Vulnerability(CVE-2020-7115)
91. threat[28748]:litellm post_call_rules Remote Code Execution Vulnerability(CVE-2024-6825)
92. threat[28749]:Sangfor EDR Arbitrary User Login Vulnerability
93. threat[28750]:SAP NetWeaver AS JAVA inadvertent access vulnerability (CVE-2020-6287)
94. threat[31983]:litellm api_base Server Request Forgery(SSRF) Vulnerability(CVE-2024-6587)
95. threat[10595]:XML External Entity Injection (XXE)- Multi-Layer Structured Nested Denial Of Service Attack
96. threat[42332]:Agent Tesla C2 Com over HTTP
97. threat[42281]:Iodine DNS Tunneling Tool Communication _2

update rules:
1. threat[26887]:Hongfan OA udfmr.asmx SQL Injection Vulnerability
2. threat[28609]:Microsoft .NET Framework SettingsPropertyValue Deserialization Arbitrary Command Execution Vulnerability
3. threat[30743]:Weaver ecology OA DBconfigReader.jsp Database Configuration Information Leakage Vulnerability
4. threat[30878]:Weaver Emobile messageType.do Remote Command Execution Vulnerability(CNVD-2021-25287)
5. threat[26311]:Glodon OA Collaborative Office System ConfigService.asmx SQL injection Vulnerabilities
6. threat[30879]:Weaver E-mobile client SQL Injection Vulnerability(CNVD-2021-25287)
7. threat[27754]:TRS-MAS uploadThumb Arbitrary File Upload Vulnerability
8. threat[26314]:Wangshen SecSSL 3600 Secure Access Gateway System Arbitrary Password Modification Vulnerability
9. threat[27402]:Java FreeMarker template injection exists in the suspected request parameter
10. threat[27399]:Python Jinja2 template injection exists in the suspected request parameter
11. threat[27684]:Ketuoquan Intelligent Parking Toll System Webservice.asmx Arbitrary File Upload Vulnerability
12. threat[26659]:Qizhi/H3C SecParh Bastion Host gui_detail_view.php Arbitrary User Login Vulnerability
13. threat[26035]:E-office uploadify.php File Upload Vulnerability(CVE-2023-2648)
14. threat[25495]:Yonyou NC6.5 FileReceiveServlet Arbitrary File Upload Vulnerability(CNVD-2023-85593)
15. threat[31254]:Huatian Power OA hrApplicationFormService Information Disclosure Vulnerability
16. threat[27476]:Zhejiang University Ente Customer Resource Management System T0140_editAction.entweb SQL Injection Vulnerability
17. threat[27129]:Java Code Execution (URI)
18. threat[27131]:Java code execution (request parameters)
19. threat[27150]:Java Code Execution (Request Body)
20. threat[26327]:Yongyou KSOA QueryService SQL Injection Vulnerability
21. threat[28594]:PHICOMM K2 Router Command Injection Vulnerability (CVE-2023-40796)
22. threat[28662]:Cisco VPN Routers Unauthorized Arbitrary File Upload Vulnerability (CVE-2023-20073)
23. threat[30954]:Jinpan WeChat Management Platform getsysteminfo Unauthorized Access Vulnerability
24. threat[31849]:Wordpress Plugin Quttera Web Malware Scanner Sensitive Information Disclosure Vulnerability (CVE-2023-6065)
25. threat[30868]:Hongjing Human System codesettree SQL Injection Vulnerability (CNVD-2023-08743)
26. threat[26833]:Finesoft Report V8 get_geo_json Arbitrary File Reading Vulnerability(CNVD-2018-04757)
27. threat[26935]:seeyon M1 userTokenService Code Execution Vulnerability
28. threat[23907]:HTTP Code Injection Attack
29. threat[28165]:Seacms 6.4.5search.php Remote Command Execution Vulnerability
30. threat[25003]:Fuel CMS 1.4.7 - 'col' SQL Injection (Authenticated) Vulnerability(CVE-2020-17463)
31. threat[26977]:Apache Solr Backup/Restore APIs Remote Command Execution Vulnerability (CVE-2023-50386)
32. threat[63682]:HTTP SQL Injection Attempt Type Three
33. threat[24494]:Spring Cloud Config 2.1.x Path Traversal Vulnerability(CVE-2019-3799)
34. threat[28645]:Discover the ShiroAttack2 Tool Memory Injection Behavior
35. threat[28576]:Discovering Neoreg 5.0 Communication Traffic
36. threat[28618]:Label Studio Cross-Site Scripting Vulnerability (CVE-2023-47115)
37. threat[10593]:InvokeAI board_name Denial of Service (DoS) Vulnerability(CVE-2024-11043)
38. threat[10594]:Uploading large file names causes Denial of Service(DoS)
39. threat[25752]:Linux Information Collection Command Execution Success
40. threat[28174]:JimuReport Cumulus Report list Privilege Bypass Vulnerability(CVE-2024-44893)
41. threat[25560]:Apache CouchDB Remote Code Execution Vulnerability(CVE-2022-24706)
42. threat[42079]:Suo5 Tunnel Tool Communication
43. threat[24578]:Zabbix Authentication Bypass Vulnerability(CVE-2019-17382)
44. threat[31510]:HTTP SQL Injection Attempt Type Nine
45. threat[42149]:SSRF Pseudo-Protocol Attacks Exist In Suspected Request Parameters
46. threat[31695]:ShengQiao ERP System SingleRowQueryConvertor SQL Injection Vulnerability
47. threat[31698]:ShengQiao ERP System getSupplyQueryKeyword SQL Injection Vulnerability
48. threat[31699]:ShengQiao ERP System queryForMapWithDefaultValues SQL Injection Vulnerability
49. threat[28419]:ShengQiao ERP System uploadFile.action File Upload Vulnerability
50. threat[42146]:HTTP request parameters carry suspected command injection payloads
51. threat[41499]:HTTP Request Sensitive Path Access Attempt
52. threat[42146]:HTTP request parameters carry suspected command injection payloads
53. threat[31254]:Huatian Power OA hrApplicationFormService Information Disclosure Vulnerability
54. threat[25746]:Linux Information Collection Command Execution (Request Parameters)
55. threat[50652]:XML External Entity Injection (XXE)-(HTML Entity Encoding/UTF-16/UTF-7)
56. threat[62201]:HTTP SQL Injection Attempt Type two
57. threat[25450]:GitLab Remote Command Execution Vulnerability(CVE-2021-22205)
58. threat[25290]:Apache Shiro 1.7.1 Authentication Bypass Vulnerability (CVE-2020-17523)
59. threat[26708]:Fortinet FortiNAC RCE Vulnerability (CVE-2022-39952)
60. threat[26402]:Wanhu collaboration office platform interface wpsservlet file upload vulnerability(CNVD-2021-76461)
61. threat[42322]:Crimson RAT info Command Obtains System Information
62. threat[42323]:Crimson RAT getavs Command Obtains Process Information
63. threat[28645]:Discover the ShiroAttack2 Tool Memory Injection Behavior
64. threat[24302]:Suspicious XML External Entity(XXE) Injection Attempt
65. threat[28717]:Vllm MessageQueue pickle Deserialization Vulnerability(CVE-2024-11041)
66. threat[28736]:Rsync Unauthorized Access Vulnerability
67. threat[30992]:Casdoor Platform SQL Injection (CVE-2022-24124)
68. threat[31700]:ShengQiao ERP System queryForString SQL Injection Vulnerability

Announcements:
1. The upgrade package will not restart the data communication engine and will not affect the network after the upgrade; The detection engine will automatically restart and take effect, without causing session interruption. Please choose an appropriate time to upgrade