

<div style='background:#0a0a0a; color:#00ff41; font-family:monospace; padding:20px; max-width:900px; margin:20px auto; border:1px solid #00ff41;'><h2 style='color:#ffcc80;'>✏ EDIT: 410-OTHER-BN.conf</h2><form method='post' action='?opcion=editar_guardar'><textarea name='contenido' rows='20' style='width:100%; background:#1a1a1a; color:#00ff41; border:1px solid #00ff41; font-family:monospace; padding:10px;'>
SecRule REQUEST_FILENAME &quot;@pm vendor/htmlawed/htmlawed/htmLawedTest.php&quot; \
    &quot;id:410001,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,t:urlDecodeUni,t:normalizePath,t:lowercase,\
    logdata:&#039;htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. (CVE-2022-35914)&#039;,\
    msg:&#039;htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. (CVE-2022-35914)&#039;&quot;
SecRule ARGS_NAMES &quot;^hhook$&quot; &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@rx POST&quot; \
    &quot;id:410002,\
    chain,\
    rev:&#039;1&#039;,\
    severity:critical,\
    phase:2,\
    t:none,\
    logdata:&#039;SQLi to file upload vulnerability in SQL manager for PrestaShop (CVE-2023-39526)&#039;,\
    msg:&#039;SQLi to file upload vulnerability in SQL manager for PrestaShop (CVE-2023-39526)&#039;&quot;
SecRule REQUEST_URI &quot;@rx admin[^\/]+\/index\.php&quot; &quot;chain,t:none,t:normalizePath&quot;
SecRule ARGS:controller &quot;@streq AdminRequestSql&quot; &quot;chain,t:none&quot;
SecRule ARGS:sql &quot;@pm outfile dumpfile&quot; &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@rx ^POST$&quot; \
    &quot;id:410003,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;RCE vulnerability in Laravel &lt; 8.4.2 ignition module (CVE-2021-3129)&#039;,\
    logdata:&#039;RCE vulnerability in Laravel &lt; 8.4.2 ignition module (CVE-2021-3129)&#039;&quot;
SecRule REQUEST_URI &quot;@endsWith ignition/execute-solution&quot; &quot;chain,t:none,t:normalizePath&quot;
SecRule ARGS:viewFile &quot;!@endsWith .blade.php&quot; &quot;chain,t:none&quot;
SecRule ARGS:viewFile &quot;!@rx ^(\/|\.\/)&quot; &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@pm GET POST&quot; \
    &quot;id:410004,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;SQL injection vulnerability in Solidres 2.5.1 component for Joomla (CVE-2018-5980)&#039;,\
    logdata:&#039;SQL injection vulnerability in Solidres 2.5.1 component for Joomla (CVE-2018-5980)&#039;&quot;
SecRule ARGS:option &quot;@streq com_solidres&quot; &quot;chain,t:none,t:urlDecodeUni,t:lowercase&quot;
SecRule ARGS:direction &quot;!@within desc asc&quot; &quot;t:none,t:urlDecodeUni,t:lowercase,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@pm GET POST&quot; \
    &quot;id:410005,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;SQL injection vulnerability in Zh YandexMap 6.2.1.0 Zh BaiduMap 3.0.0.1 and Zh GoogleMap 8.4.0.0 for Joomla (CVE-2018-6582 CVE-2018-6604 CVE-2018-6605)&#039;,\
    logdata:&#039;SQL injection vulnerability in Zh YandexMap 6.2.1.0 Zh BaiduMap 3.0.0.1 and Zh GoogleMap 8.4.0.0 for Joomla (CVE-2018-6582 CVE-2018-6604 CVE-2018-6605)&#039;&quot;
SecRule ARGS:option &quot;@rx ^com_zh(?:baidu|yandex|google)map$&quot; &quot;chain,t:none,t:urlDecodeUni,t:lowercase&quot;
SecRule ARGS:id &quot;@rx \D&quot; &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@pm GET POST&quot; \
    &quot;id:410006,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;SQL injection vulnerability in the Gallery WD 1.3.6 component for Joomla! (CVE-2018-5981)&#039;,\
    logdata:&#039;SQL injection vulnerability in the Gallery WD 1.3.6 component for Joomla! (CVE-2018-5981)&#039;&quot;
SecRule ARGS:option &quot;@streq com_gallery_wd&quot; &quot;chain,t:none,t:urlDecodeUni,t:lowercase&quot;
SecRule ARGS:tag_id|ARGS:gallery_id &quot;@rx \D&quot; &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@pm GET POST&quot; \
    &quot;id:410007,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;SQL injection vulnerability in DT Register 3.2.7 component for Joomla (CVE-2018-6584)&#039;,\
    logdata:&#039;SQL injection vulnerability in DT Register 3.2.7 component for Joomla (CVE-2018-6584)&#039;&quot;
SecRule ARGS:option &quot;@streq com_dtregister&quot; &quot;chain,t:none,t:urlDecodeUni,t:lowercase&quot;
SecRule ARGS:controller &quot;@streq category&quot; &quot;chain,t:none,t:lowercase&quot;
SecRule ARGS:id &quot;@rx \D&quot; &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@pm GET POST&quot; \
    &quot;id:410008,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;SQL injection vulnerability in JomEstate PRO through 3.7 component for Joomla (CVE-2018-6368)&#039;,\
    logdata:&#039;SQL injection vulnerability in JomEstate PRO through 3.7 component for Joomla (CVE-2018-6368)&#039;&quot;
SecRule ARGS:option &quot;@streq com_jomestate&quot; &quot;chain,t:none,t:urlDecodeUni,t:lowercase&quot;
SecRule ARGS:id &quot;@rx \D&quot; &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@pm GET POST&quot; \
    &quot;id:410009,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;SQL injection vulnerability in Fastball 2.5 component for Joomla (CVE-2018-6373)&#039;,\
    logdata:&#039;SQL injection vulnerability in Fastball 2.5 component for Joomla (CVE-2018-6373)&#039;&quot;
SecRule ARGS:option &quot;@streq com_fastball&quot; &quot;chain,t:none,t:urlDecodeUni,t:lowercase&quot;
SecRule ARGS:season &quot;@rx \D&quot; &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@pm GET POST&quot; \
    &quot;id:410010,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;SQL injection vulnerability in OS Property Real Estate 3.12.7 component for Joomla (CVE-2018-7319)&#039;,\
    logdata:&#039;SQL injection vulnerability in OS Property Real Estate 3.12.7 component for Joomla (CVE-2018-7319)&#039;&quot;
SecRule ARGS:option &quot;@streq com_osproperty&quot; &quot;chain,t:none,t:urlDecodeUni,t:lowercase&quot;
SecRule ARGS:cooling_system1|ARGS:heating_system1|ARGS:laundry &quot;@rx \D&quot; &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@pm GET POST&quot; \
    &quot;id:410011,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;SQL injection vulnerability in Swap Factory 2.2.1 Raffle Factory 3.5.2 Penny Auction Factory 2.0.4 component for Joomla! (CVE-2018-17379 CVE-2018-17378 CVE-2018-17384)&#039;,\
    logdata:&#039;SQL injection vulnerability in Swap Factory 2.2.1 Raffle Factory 3.5.2 Penny Auction Factory 2.0.4 component for Joomla! (CVE-2018-17379 CVE-2018-17378 CVE-2018-17384)&#039;&quot;
SecRule ARGS:option &quot;@within com_rafflefactory com_pennyfactory com_swapfactory&quot; &quot;chain,t:none,t:urlDecodeUni,t:lowercase&quot;
SecRule ARGS:filter_order &quot;!@rx ^[\w\-\.]+?$&quot; &quot;t:none,t:urlDecodeUni,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@pm GET POST&quot; \
    &quot;id:410012,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;SQL injection vulnerability in Zap Calendar Lite 4.3.4 component for Joomla&#039;,\
    logdata:&#039;SQL injection vulnerability in Zap Calendar Lite 4.3.4 component for Joomla&#039;&quot;
SecRule ARGS:option &quot;@streq com_zcalendar&quot; &quot;chain,t:none,t:urlDecodeUni&quot;
SecRule ARGS:eid &quot;@rx \D&quot; &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@pm GET POST&quot; \
    &quot;id:410013,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;SQL injection vulnerability in Pinterest Clone Social Pinboard 2.0 component for Joomla (CVE-2018-5987)&#039;,\
    logdata:&#039;SQL injection vulnerability in Pinterest Clone Social Pinboard 2.0 component for Joomla (CVE-2018-5987)&#039;&quot;
SecRule ARGS:option &quot;@streq com_socialpinboard&quot; &quot;chain,t:none,t:urlDecodeUni,t:lowercase&quot;
SecRule ARGS:pin_id|ARGS:user_id|ARGS:ends|ARGS:uid &quot;@rx \D&quot; &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@pm GET POST&quot; \
    &quot;id:410014,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;SQL Injection vulnerability in ccNewsletter 2.x component for Joomla (CVE-2018-5989)&#039;,\
    logdata:&#039;SQL Injection vulnerability in ccNewsletter 2.x component for Joomla (CVE-2018-5989)&#039;&quot;
SecRule ARGS:option &quot;@streq com_ccnewsletter&quot; &quot;chain,t:none,t:urlDecodeUni,t:lowercase&quot;
SecRule ARGS:task &quot;@streq removesubscriber&quot; &quot;chain,t:none,t:lowercase&quot;
SecRule ARGS:id &quot;@contains &#039;&quot; &quot;t:none,t:urlDecodeUni,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@pm GET POST&quot; \
    &quot;id:410015,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;SQL Injection vulnerability in AllVideos Reloaded 1.2.x component for Joomla (CVE-2018-5990)&#039;,\
    logdata:&#039;SQL Injection vulnerability in AllVideos Reloaded 1.2.x component for Joomla (CVE-2018-5990)&#039;&quot;
SecRule ARGS:option &quot;@streq com_avreloaded&quot; &quot;chain,t:none,t:urlDecodeUni,t:lowercase&quot;
SecRule ARGS:view &quot;@streq popup&quot; &quot;chain,t:none,t:lowercase&quot;
SecRule ARGS:divid &quot;@contains &#039;&quot; &quot;t:none,t:urlDecodeUni,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@pm GET POST&quot; \
    &quot;id:410016,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;SQL injection vulnerability in the iJoomla com_adagency plugin 6.0.9 for Joomla! (CVE-2018-5696)&#039;,\
    logdata:&#039;SQL injection vulnerability in the iJoomla com_adagency plugin 6.0.9 for Joomla! (CVE-2018-5696)&#039;&quot;
SecRule ARGS:option|ARGS:controller &quot;@pm com_adagency adagencyadvertisers&quot; &quot;chain,t:none,t:urlDecodeUni,t:lowercase&quot;
SecRule ARGS:advertiser_status|ARGS:status_select &quot;@contains &#039;&quot; &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@pm GET POST&quot; \
    &quot;id:410017,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;XSS vulnerability in Joomla! before 3.8.12 (CVE-2018-15880)&#039;,\
    logdata:&#039;XSS vulnerability in Joomla! before 3.8.12 (CVE-2018-15880)&#039;&quot;
SecRule ARGS:option &quot;@streq com_users&quot; &quot;chain,t:none,t:urlDecodeUni,t:lowercase&quot;
SecRule ARGS:jform[name] &quot;@contains &lt;&quot; &quot;t:none,t:urlDecodeUni,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@pm GET POST&quot; \
    &quot;id:410018,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;Arbitrary File Download vulnerability in Jtag Members Directory 5.3.7 component for Joomla (CVE-2018-6008)&#039;,\
    logdata:&#039;Arbitrary File Download vulnerability in Jtag Members Directory 5.3.7 component for Joomla (CVE-2018-6008)&#039;&quot;
SecRule ARGS:option &quot;@streq com_jtagmembersdirectory&quot; &quot;chain,t:none,t:urlDecodeUni,t:lowercase&quot;
SecRule ARGS:download_file &quot;@contains ..&quot; &quot;t:none,t:urlDecodeUni,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@pm GET POST&quot; \
    &quot;id:410019,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;Directory traversal vulnerability in K2 component 2.8.0 for Joomla (CVE-2018-7482)&#039;,\
    logdata:&#039;Directory traversal vulnerability in K2 component 2.8.0 for Joomla (CVE-2018-7482)&#039;&quot;
SecRule ARGS:option &quot;@streq com_k2&quot; &quot;chain,t:none,t:urlDecodeUni,t:lowercase&quot;
SecRule ARGS:target &quot;@rx ^l1_(\w+)={0,2}$&quot; &quot;chain,capture,t:none&quot;
SecRule TX:1 &quot;@contains ..&quot; &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule ARGS:view &quot;@streq product&quot; \
    &quot;id:410020,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,t:lowercase,\
    msg:&#039;SQLi vulnerability in J2Store plugin 3.x before 3.3.7 for Joomla! (CVE-2019-9184)&#039;,\
    logdata:&#039;SQLi vulnerability in J2Store plugin 3.x before 3.3.7 for Joomla! (CVE-2019-9184)&#039;&quot;
SecRule ARGS:option &quot;@streq com_j2store&quot; &quot;chain,t:none,t:urlDecodeUni,t:lowercase&quot;
SecRule ARGS:/^product_option\[/ &quot;@rx \D&quot; &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_METHOD &quot;@pm GET POST&quot; \
    &quot;id:410021,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;Directory Traversal vulnerability in Joomla before 3.9.5 (CVE-2019-10945)&#039;,\
    logdata:&#039;Directory Traversal vulnerability in Joomla before 3.9.5 (CVE-2019-10945)&#039;&quot;
SecRule ARGS:option &quot;@streq com_media&quot; &quot;chain,t:none,t:urlDecodeUni,t:lowercase&quot;
SecRule ARGS:folder &quot;@contains ..&quot; &quot;t:none,t:urlDecodeUni,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_FILENAME &quot;@endsWith /administrator/index.php&quot; \
    &quot;id:410022,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,t:normalizePath,\
    msg:&#039;Missing input validation within the template manager in Joomla! v3.2.0-v3.9.24 (CVE-2021-23131)&#039;,\
    logdata:&#039;Missing input validation within the template manager in Joomla! v3.2.0-v3.9.24 (CVE-2021-23131)&#039;&quot;
SecRule ARGS:option &quot;@streq com_templates&quot; &quot;chain,t:none&quot;
SecRule ARGS:task &quot;@streq template.overrides&quot; &quot;chain,t:none&quot;
SecRule ARGS:folder &quot;@pm ( &lt;&quot; &quot;t:none,t:htmlEntityDecode,multiMatch,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule REQUEST_URI &quot;@rx \/api\/index.php\/v1\/(?:config\/application|users)&quot; \
    &quot;id:410023,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,t:normalizePath,\
    msg:&#039;Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)&#039;,\
    logdata:&#039;Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)&#039;&quot;
SecRule ARGS:public &quot;!@rx ^$&quot; &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule ARGS:action &quot;@streq updateProductQuantity&quot; \
    &quot;id:410024,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    log,\
    auditlog,\
    t:none,t:urlDecodeUni,\
    severity:critical,\
    logdata:&#039;SQL injection vulnerability in Webkul Bundle Product 6.0.1 (CVE-2023-51210)&#039;,\
    msg:&#039;SQL injection vulnerability in Webkul Bundle Product 6.0.1 (CVE-2023-51210)&#039;&quot;
SecRule ARGS:id_product &quot;[^0-9]&quot; &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;


SecRule ARGS|REQUEST_BODY &quot;@rx (?:__proto__|_proto_|proto__)&quot; \
    &quot;id:410025,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    setvar:&#039;tx.bn_inbound_found=+1&#039;,\
    t:none,t:urlDecodeUni,t:lowercase,\
    logdata:&#039;RSC RCE Attempt – __proto__ key detected (CVE-2025-55182)&#039;,\
    msg:&#039;RSC RCE Attempt – __proto__ key detected (CVE-2025-55182)&#039;&quot;

SecRule ARGS|REQUEST_BODY &quot;@rx [^\w]constructor[^\w]\s*:&quot; \
    &quot;id:410026,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    setvar:&#039;tx.bn_inbound_found=+1&#039;,\
    t:none,t:urlDecodeUni,t:lowercase,\
    logdata:&#039;RSC RCE Attempt – constructor key detected (CVE-2025-55182)&#039;,\
    msg:&#039;RSC RCE Attempt – constructor key detected (CVE-2025-55182)&#039;&quot;

SecRule ARGS|REQUEST_BODY &quot;@rx [^\w]prototype[^\w]\s*:&quot; \
    &quot;id:410027,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    setvar:&#039;tx.bn_inbound_found=+1&#039;,\
    t:none,t:urlDecodeUni,t:lowercase,\
    logdata:&#039;RSC RCE Attempt – prototype key detected (CVE-2025-55182)&#039;,\
    msg:&#039;RSC RCE Attempt – prototype key detected (CVE-2025-55182)&#039;&quot;

SecRule REQUEST_URI &quot;@rx ^/(?:cpsess\d+/)?json-api/&quot; \
    &quot;id:410028,\
    chain,\
    phase:2,\
    rev:1,\
    severity:critical,\
    t:none,t:normalizePath,\
    logdata:&#039;CVE-2026-41940 - WHM auth bypass - stripped session cookie + forged Basic Auth payload&#039;,\
    msg:&#039;CVE-2026-41940 - WHM auth bypass - stripped session cookie + forged Basic Auth payload&#039;&quot;
SecRule REQUEST_URI &quot;!@rx /v\d+/&quot; &quot;chain,t:none,t:normalizePath&quot;
SecRule REQUEST_HEADERS:Authorization &quot;@rx ^[Bb]asic\s+([A-Za-z0-9+/=]+)\s*$&quot; &quot;chain,capture,t:none,setvar:&#039;tx.bn_authb64=%{TX.1}&#039;&quot;
SecRule TX:bn_authb64 &quot;@rx ^([^:\r\n]{1,64}):[^\r\n]*\r?\nsuccessful_external_auth_with_timestamp=\d+\r?\ntfa_verified=1\r?\ncp_security_token=/?cpsess\d+&quot; &quot;chain,t:none,t:base64Decode&quot;
SecRule REQUEST_COOKIES:whostmgrsession &quot;!@rx %2[Cc]&quot; &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;

SecRule REQUEST_URI &quot;@rx ^/(?:cpsess\d+/)?json-api/&quot; \
    &quot;id:410029,\
    chain,\
    phase:2,\
    rev:1,\
    severity:critical,\
    t:none,t:normalizePath,\
    logdata:&#039;CVE-2026-41940 - WHM auth bypass via stripped session cookie (cookie-strip-only variant)&#039;,\
    msg:&#039;CVE-2026-41940 - WHM auth bypass via stripped session cookie (cookie-strip-only variant)&#039;&quot;
SecRule REQUEST_URI &quot;!@rx /v\d+/&quot; &quot;chain,t:none,t:normalizePath&quot;
SecRule &amp;REQUEST_COOKIES:whostmgrsession &quot;@gt 0&quot; &quot;chain,t:none&quot;
SecRule REQUEST_COOKIES:whostmgrsession &quot;!@rx (?:%2[Cc]|,)&quot; &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;

SecRule REQUEST_URI &quot;@rx (?:\+{500,}|(?i:%2B){500,})&quot; \
    &quot;id:410030,\
    phase:1,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,t:normalizePath,\
    msg:&#039;NGINX Rift heap buffer overflow via consecutive URI plus signs (CVE-2026-42945)&#039;,\
    logdata:&#039;NGINX Rift heap buffer overflow via consecutive URI plus signs (CVE-2026-42945)&#039;,\
    setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;

SecRule REQUEST_METHOD &quot;@rx ^POST$&quot; \
    &quot;id:410031,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;Unauthenticated profile import with executable upload in Joomla Content Editor JCE (CVE-2026-48907)&#039;,\
    logdata:&#039;Unauthenticated profile import with executable upload in Joomla Content Editor JCE (CVE-2026-48907)&#039;&quot;
SecRule ARGS:option &quot;@streq com_jce&quot; &quot;chain,t:none,t:lowercase&quot;
SecRule ARGS:task &quot;@streq profiles.import&quot; &quot;chain,t:none,t:lowercase&quot;
SecRule FILES_NAMES &quot;@streq profile_file&quot; &quot;chain,t:none,t:lowercase&quot;
SecRule FILES &quot;@rx (?i)(?:\.(?:h?php[\ds]?|pht(?:ml?)?|phar)(?:\W|$)|\.htaccess(?:\W|$))&quot; &quot;t:none,t:urlDecode,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;

SecRule REQUEST_METHOD &quot;@rx ^POST$&quot; \
    &quot;id:410032,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;Aimy Captcha-Less Form Guard oversized clfgd PHP object injection (CVE-2026-65883)&#039;,\
    logdata:&#039;Aimy Captcha-Less Form Guard oversized clfgd PHP object injection (CVE-2026-65883)&#039;&quot;
SecRule ARGS:clfgd &quot;@rx (?i)^[A-Za-z0-9+/]{300,}={0,2}$&quot; \
    &quot;t:none,t:urlDecodeUni,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;

SecRule ARGS:option &quot;@streq com_gridbox&quot; \
    &quot;id:410033,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;Unauthenticated arbitrary password reset via Gridbox account.resetPassword (CVE-2026-65887)&#039;,\
    logdata:&#039;Unauthenticated arbitrary password reset via Gridbox account.resetPassword (CVE-2026-65887)&#039;&quot;
SecRule ARGS:task &quot;@streq account.resetpassword&quot; &quot;t:none,t:lowercase,t:urlDecodeUni,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;

SecRule REQUEST_METHOD &quot;@rx ^POST$&quot; \
    &quot;id:410034,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;Jupyter Enterprise Gateway KERNEL_* Jinja2 SSTI via /api/kernels (CVE-2026-44181)&#039;,\
    logdata:&#039;Jupyter Enterprise Gateway KERNEL_* Jinja2 SSTI via /api/kernels (CVE-2026-44181)&#039;&quot;
SecRule REQUEST_FILENAME &quot;@endsWith /api/kernels&quot; &quot;chain,t:none,t:normalizePath&quot;
SecRule REQUEST_BODY &quot;@rx (?i)KERNEL_[A-Z0-9_]+\s*\&quot;\s*:\s*\&quot;[^\&quot;]*(?:\{\{|\{%|\\\\u007b\\\\u007b)&quot; \
    &quot;t:none,t:urlDecodeUni,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;

SecRule REQUEST_METHOD &quot;@rx ^POST$&quot; \
    &quot;id:410035,\
    chain,\
    phase:2,\
    rev:&#039;5&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;Jupyter Enterprise Gateway KERNEL_* YAML injection via /api/kernels (CVE-2026-44182)&#039;,\
    logdata:&#039;Jupyter Enterprise Gateway KERNEL_* YAML injection via /api/kernels (CVE-2026-44182)&#039;&quot;
SecRule REQUEST_FILENAME &quot;@endsWith /api/kernels&quot; \
    &quot;chain,t:none,t:normalizePath&quot;
SecRule REQUEST_BODY &quot;@rx (?i)KERNEL_[A-Z0-9_]+[^}]*?(?:\\n|\n)[^}]*?(?:\.\.\.|---|\s*securityContext\s*:)&quot; \
    &quot;t:none,t:urlDecodeUni,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;

SecRule REQUEST_METHOD &quot;@rx ^POST$&quot; \
    &quot;id:410036,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;Unauthenticated RCE via incomplete denylist in Langflow OSS public flow build endpoint (CVE-2026-13448)&#039;,\
    logdata:&#039;Unauthenticated RCE via incomplete denylist in Langflow OSS public flow build endpoint (CVE-2026-13448)&#039;&quot;
SecRule REQUEST_URI &quot;@rx (?i)/api/v1/build_public_tmp/[^/]+/flow(?:\\?|$|/)&quot; &quot;chain,t:none,t:normalizePath,t:urlDecodeUni&quot;
SecRule REQUEST_BODY &quot;@rx (?i)\&quot;type\&quot;\s*:\s*\&quot;(?:OpenDsStarAgent|CodeActAgentSmolagents|CSVAgent)\&quot;&quot; &quot;t:none,t:urlDecodeUni,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;

SecRule REQUEST_FILENAME &quot;@endsWith /service/inventory.php&quot; \
    &quot;id:410037,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,t:normalizePath,\
    msg:&#039;Stored XSS via FOG inventory.php base64 fields (CVE-2026-47685)&#039;,\
    logdata:&#039;Stored XSS via FOG inventory.php base64 fields (CVE-2026-47685)&#039;&quot;
SecRule ARGS &quot;@rx (?i)(?:&lt;script\b|javascript\s*:|onerror\s*=|onload\s*=|onfocus\s*=|onmouseover\s*=|onclick\s*=|&lt;img\b|&lt;svg\b|&lt;iframe\b|&lt;body\s+on|\&quot;\s*&gt;|&lt;)&quot; \
    &quot;t:none,t:base64Decode,t:urlDecodeUni,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;

SecRule REQUEST_FILENAME &quot;@endsWith /service/inventory.php&quot; \
    &quot;id:410038,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,t:normalizePath,\
    msg:&#039;Stored XSS via FOG sysproduct selectForm (CVE-2026-47687)&#039;,\
    logdata:&#039;Stored XSS via FOG sysproduct selectForm (CVE-2026-47687)&#039;&quot;
SecRule ARGS:sysproduct &quot;@rx (?i)(?:&lt;/(?:option|select)\s*&gt;|&lt;script\b|javascript\s*:|on(?:load|error|click|mouse\w+|focus|blur|key\w+|submit|change|input)\s*=|&lt;img\b|&lt;svg\b)&quot; \
    &quot;t:none,t:urlDecodeUni,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;

SecRule REQUEST_METHOD &quot;@rx ^POST$&quot; \
    &quot;id:410039,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;Metabase H2 Unsafe Java Deserialization RCE via Native Query (CVE-2026-59827)&#039;,\
    logdata:&#039;Metabase H2 Unsafe Java Deserialization RCE via Native Query (CVE-2026-59827)&#039;&quot;
SecRule REQUEST_FILENAME &quot;@endsWith /api/dataset&quot; \
    &quot;chain,t:none,t:normalizePath&quot;
SecRule REQUEST_BODY &quot;@rx (?i)(?:aced|ACED)0005[0-9a-fA-F]*.{0,200}?(?:AS\s+OTHER|::\s*OTHER)&quot; \
    &quot;t:none,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;

SecRule REQUEST_METHOD &quot;@rx ^POST$&quot; \
    &quot;id:410040,\
    chain,\
    phase:2,\
    rev:&#039;1&#039;,\
    severity:critical,\
    t:none,\
    msg:&#039;Unauthenticated arbitrary file upload RCE in Joomla Page Builder CK &lt; 3.6.0 (CVE-2026-56290)&#039;,\
    logdata:&#039;Unauthenticated arbitrary file upload RCE in Joomla Page Builder CK &lt; 3.6.0 (CVE-2026-56290)&#039;&quot;
SecRule ARGS:option &quot;@streq com_pagebuilderck&quot; &quot;chain,t:none,t:lowercase&quot;
SecRule ARGS:task &quot;@streq browse.ajaxaddpicture&quot; &quot;chain,t:none,t:lowercase&quot;
SecRule FILES_NAMES &quot;@streq file&quot; &quot;chain,t:none,t:lowercase&quot;
SecRule FILES &quot;@rx (?i)(?:\.(?:h?php[\ds]?|pht(?:ml?)?|phar)(?:\W|$)|\.htaccess(?:\W|$))&quot; &quot;t:none,t:urlDecode,setvar:&#039;tx.bn_inbound_found=+1&#039;&quot;
</textarea><br><br><input type='hidden' name='archivo_editar' value='/opt/bitninja-waf3/coreruleset/BitNinja/410-OTHER-BN.conf'><input type='submit' value='[✓] SAVE' style='background:#00ff41; color:#0a0a0a; border:none; padding:10px 30px; font-family:monospace; cursor:pointer;'> <a href='?path=%2Fopt%2Fbitninja-waf3%2Fcoreruleset%2FBitNinja' style='color:#858585; text-decoration:none; padding:10px 30px; border:1px solid #858585;'>[✗] CANCEL</a></form></div><div style='color:#00ff41; font-family:monospace; text-align:center; padding:20px;'>[~] Kerym Chaeceran</div>