WAF - WAF Release - 2025-06-16

This week’s roundup highlights multiple critical vulnerabilities across popular web frameworks, plugins, and enterprise platforms. The focus lies on remote code execution (RCE), server-side request forgery (SSRF), and insecure file upload vectors that enable full system compromise or data exfiltration.

Key Findings

• Cisco IOS XE (CVE-2025-20188): Critical RCE vulnerability enabling unauthenticated attackers to execute arbitrary commands on network infrastructure devices, risking total router compromise.
• Axios (CVE-2024-39338): SSRF flaw impacting server-side request control, allowing attackers to manipulate internal service requests when misconfigured with unsanitized user input.
• vBulletin (CVE-2025-48827, CVE-2025-48828): Two high-impact RCE flaws enabling attackers to remotely execute PHP code, compromising forum installations and underlying web servers.
• Invision Community (CVE-2025-47916): A critical RCE vulnerability allowing authenticated attackers to run arbitrary code in community platforms, threatening data and lateral movement risk.
• CrushFTP (CVE-2025-32102, CVE-2025-32103): SSRF vulnerabilities in upload endpoint processing permit attackers to pivot internal network scans and abuse internal services.
• Roundcube (CVE-2025-49113): RCE via email processing enables attackers to execute code upon viewing a crafted email — particularly dangerous for webmail deployments.
• WooCommerce WordPress Plugin (CVE-2025-47577): Dangerous file upload vulnerability permits unauthenticated users to upload executable payloads, leading to full WordPress site takeover.
• Cross-Site Scripting (XSS) Detection Improvements: Enhanced detection patterns.

Impact

These vulnerabilities span core systems — from routers to e-commerce to email. RCE in Cisco IOS XE, Roundcube, and vBulletin poses full system compromise. SSRF in Axios and CrushFTP supports internal pivoting, while WooCommerce’s file upload bug opens doors to mass WordPress exploitation.

RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionCommentsCloudflare Managed Ruleset...35fefd53100783Cisco IOS XE - Remote Code Execution - CVE:CVE-2025-20188LogBlockThis is a New DetectionCloudflare Managed Ruleset...8332af5d100784Axios - SSRF - CVE:CVE-2024-39338LogBlockThis is a New DetectionCloudflare Managed Ruleset...2e1648d2100785

vBulletin - Remote Code Execution - CVE:CVE-2025-48827, CVE:CVE-2025-48828

LogBlockThis is a New DetectionCloudflare Managed Ruleset...0edcf1ef100786Invision Community - Remote Code Execution - CVE:CVE-2025-47916LogBlockThis is a New DetectionCloudflare Managed Ruleset...d6f5eb48100791CrushFTP - SSRF - CVE:CVE-2025-32102, CVE:CVE-2025-32103LogBlockThis is a New DetectionCloudflare Managed Ruleset...30baa18a100792Roundcube - Remote Code Execution - CVE:CVE-2025-49113LogBlockThis is a New DetectionCloudflare Managed Ruleset...229ba236100793XSS - OntoggleLogDisabledThis is a New DetectionCloudflare Managed Ruleset...fa338296100794

WordPress WooCommerce Plugin - Dangerous File Upload - CVE:CVE-2025-47577

LogBlockThis is a New Detection