A person who already has a login on the Ivanti VPN server can use a flaw to take over the whole server. Attackers are already using it.

1. How it works:
2. Local account holder
3. Broker trusts DSCache
4. Privilege escalation
5. Attacker gains control
6. Attacker controls the Ivanti appliance as root

Attackers can reach store pages and data they should not be able to see or change, such as orders. Attacks are already happening against online shops.

1. How it works:
2. Attacker
3. Direct request
4. Missing check
5. Store data
6. Attacker reads or alters store data

A blockchain analysis firm had an intruder get into some internal tools. The intruder could see basic customer contact details, such as names and email addresses.

1. How it works:
2. External actor
3. Internal tools accessed
4. Customer identity data
5. Customers at risk
6. Customer contact details exposed to attacker

Attackers can send a specially crafted request to this router and make it run commands they choose. That could let them take over the device.

1. How it works:
2. Attacker sends request
3. Router parses input
4. Injected command runs
5. Device compromised
6. Attacker controls the router

Attackers on the network can send a crafted request to the router's web settings page and make it run commands on the router. A public exploit exists.

1. How it works:
2. Attacker sends request
3. Request reaches router
4. Input not sanitized
5. Commands execute
6. Attacker controls the router

A website's login session handling can be tricked by a specially crafted cookie into sending extra instructions to its cache server. This can let an attacker run commands the site never intended.

1. How it works:
2. Attacker crafts cookie
3. Request sent to site
4. CHI store builds cache key
5. Memcached reads extra commands
6. Attacker sends commands to cache server

Online posts claim that files from a private Anthropic AI model were published on a public website. The claim is unconfirmed, and the sources provided do not say what the files contain.

Attackers may be able to sneak database commands through the booking plugin's inputs, which could expose or change website data. Update the plugin to a fixed version as soon as one is available.

Prefab UI's Generative UI feature runs code meant to be isolated, but the isolation can be bypassed. Someone who can send code to it can read and change files on the server and keep running code there.

1. How it works:
2. Attacker sends code
3. FastMCP server
4. Pyodide sandbox
5. Server files
6. Attacker runs code on the server

A customer with a normal login can reach files that belong to other customers on the same server, and can read and change them. The flaw comes from a missing check on which storage volume a deployment may attach.

1. How it works:
2. Tenant with token
3. Crafted volume ID
4. Path escapes root
5. Read-write mount
6. Attacker reads and writes other tenants' data

A tenant with a sandbox can use the file feature to read, change, or delete files on the shared server running their sandbox, including other customers' files. Attackers may be able to take over the whole cluster.

1. How it works:
2. Tenant holds sandbox
3. Sends crafted file path
4. Worker joins path unsafely
5. Host file accessed as root
6. Attacker may gain cluster-admin control

A customer who submits a container image build can break out of the build's sandbox and reach files on the build machine. Those files include the machine's access token, which could be used against the rest of the system.

1. How it works:
2. Tenant submits image build
3. Shell command becomes RUN step
4. Build reaches worker filesystem
5. Worker credentials exposed
6. Tenant reads worker's service account token

Someone on the network could send a specially crafted request to this router and make it run commands they choose. Public exploit code exists, so attacks are possible.

1. How it works:
2. Attacker sends request
3. Request reaches router
4. Input not sanitized
5. Injected command runs
6. Attacker can run commands on router

Attackers on the network can send a specially crafted setup request to this router and make it run commands they choose. That can let them take control of the device.

1. How it works:
2. Attacker sends request
3. Reaches router remotely
4. Input not sanitized
5. Commands execute on device
6. Attacker controls the router

Someone on the internet may be able to send a specially crafted file upload to this router and crash it or take control of it. A public exploit is reported to exist.

1. How it works:
2. Attacker sends crafted upload
3. TFTP upload handler
4. Stack buffer overflow
5. Router memory corrupted
6. Router may crash or be taken over

Anyone who knows a secret password hard-coded in the software can forge access passes and then run their own commands on the server without logging in. Attackers can take over the server.

1. How it works:
2. Attacker forges token
3. Forged share token
4. testTransform endpoint
5. Script runs via Groovy
6. Attacker controls the server

Jpom is a web tool for managing servers. A crafted request header can trick it into granting full admin rights to anyone, with no password needed. From there, attackers can run commands on the server.

1. How it works:
2. Unauthenticated attacker
3. Malicious token header
4. Condition parser runs
5. Super-admin granted
6. Attacker controls the Jpom server

Attackers got into the Northflank hosting platform and used customers' AI service keys without permission. Those keys can be used to run up bills or access AI services as if they were the customer.

1. How it works:
2. Attacker breaches Northflank
3. Platform secrets exposed
4. AI API keys obtained
5. Keys used by attacker
6. Attacker uses customers' AI API keys

Visitors to a page with a SimpleForm form can upload files that the website server may run as programs. That can let an outsider take control of the website.

1. How it works:
2. Attacker finds form
3. Nonce read from page
4. Trailing-dot file upload
5. Server stores executable file
6. Attacker may run code on the server

A flaw in this WordPress quiz and course plugin lets users with a basic account delete files on the website's server. Deleting a key settings file can let an attacker take over the whole site.

1. How it works:
2. Attacker sends request
3. Plugin route accepts path
4. Arbitrary file deleted
5. Site takeover possible
6. Attacker can run code on the server

Someone who knows a user's password can log in to that account even when the site has not approved it or has suspended it. No prior login is needed.

1. How it works:
2. Attacker has password
3. Crafted login request
4. Verification check skipped
5. Session cookie issued
6. Attacker logs into unverified or suspended account

A WordPress plugin for managing projects has a flaw that lets people with no login run commands on the website's server. That can let them take over the site and its data.

1. How it works:
2. Unauthenticated attacker
3. Crafted REST request
4. WordPress runs validation
5. PHP functions invoked
6. Attacker executes code on the server

A networking library can be tricked into running an attacker's code when it reads data from an untrusted source. The flaw is in how it unpacks certain incoming messages, and there is no planned fix for this version line.

1. How it works:
2. Attacker crafts payload
3. Payload sent to service
4. Decoder reads frame
5. Code runs on server
6. Attacker controls the server

Anyone on the internet can send a single web request that moves all your published popups to the trash, without logging in. Your popups stop showing to visitors until someone restores them.

1. How it works:
2. Attacker sends request
3. Missing authorization check
4. Preview parameter flaw
5. All popups trashed
6. All published popups moved to trash

A WordPress booking plugin lets any logged-in user, even a basic subscriber, delete booking calendar notes that belong to others. Someone could remove important notes without permission.

1. How it works:
2. Subscriber logs in
3. Calls remove-note action
4. No capability check
5. Calendar note deleted
6. Booking calendar notes are deleted by unauthorized users

A flaw in a WordPress invoice plugin lets someone with no login run harmful code on the store's server by placing a checkout order. Store owners using the affected versions need to act.

1. How it works:
2. Attacker places order
3. Request sent to store
4. Note reaches invoice code
5. Malicious data deserialized
6. Attacker executes code on the server

Scribd, a document-sharing website, reportedly had its systems broken into. Personal account information may have been taken, so users should be alert to suspicious messages.

A data-parsing library used by some Java programs can be tricked into going around in an endless loop while reading malicious input, which can freeze or crash the program. Upgrading the library fixes it.

1. How it works:
2. Attacker sends crafted data
3. Request reaches service
4. skip() recurses without limit
5. Service stalls or crashes
6. Java service becomes unavailable

The mtools tool, which reads and writes files on DOS-style (FAT) disks, can write data past the end of a memory area. This memory error can make the program misbehave.

A login library could let someone sign in as another person. An attacker can edit a form field during Apple login so the app believes it is a different user.

1. How it works:
2. Attacker signs in
3. Attacker edits user field
4. Library merges data
5. App trusts wrong identity
6. Attacker logs in as another user

Anyone on the network can claim the administrator account of this Okta helper tool before the real owner finishes setup. The attacker then controls the tool and the Okta data it reads.

1. How it works:
2. Attacker scans network
3. Calls setup endpoint
4. Admin account created
5. Okta data accessed
6. Attacker controls the admin account

A popular Node.js library can accidentally send your custom secret header (like an API key) to a different website when the server redirects. Built-in login headers stay protected; only custom ones are at risk.

1. How it works:
2. Attacker controls endpoint
3. App sends request
4. Library follows redirect
5. Header forwarded
6. Attacker receives your custom API key

Someone who can reach the server without a login can trick it into handing over its secret signing key. With that key they can make themselves an admin and run commands on the machine.

1. How it works:
2. Anonymous attacker
3. Traversal request
4. Secret key read
5. Admin token forged
6. Attacker controls the server

Someone can send a specially crafted ICO image file to imgproxy and make the server crash or, in the worst case, let the attacker run their own code on it. No login is needed to send the image.

1. How it works:
2. Attacker sends ICO
3. imgproxy reads header
4. Tiny buffer allocated
5. Heap overwritten
6. Server crashes or attacker gains code execution

A malformed ICO image file can make the imgproxy image service crash while processing it. Crashes can take the service offline for everyone who uses it.

1. How it works:
2. Crafted ICO file
3. imgproxy loads image
4. Heap corrupted
5. Worker aborts
6. Image worker crashes, service disrupted

A specially crafted tiny icon file can make imgproxy try to reserve about 4GB of memory. Repeated requests can crash the service or slow down the server.

1. How it works:
2. Attacker sends file
3. imgproxy parses ICO
4. Huge allocation
5. Memory exhausted
6. Repeatable memory exhaustion and denial of service

A logged-in user of AdminNeo's SQLite mode can make the server delete almost any file it has permission to remove, not just database files. This can break the site or wipe important data.

1. How it works:
2. Logged-in user
3. Drop request
4. unlink() call
5. File deleted
6. Arbitrary server files get deleted

Someone who can add a special header to requests can trick your browser into sending your AdminNeo login session and database key to a different website. That can let them take over your admin session and read saved database passwords.

1. How it works:
2. Attacker adds header
3. AdminNeo builds cookie
4. Browser accepts cookie
5. Session cookies sent out
6. Attacker gets session and database key

If someone tricks you into connecting AdminNeo to a fake database server, that server can send back a specially crafted reply that makes your browser run code chosen by the attacker. This can happen without you logging in to anything.

1. How it works:
2. Attacker sets up server
3. Admin connects
4. Version string inserted
5. Script runs
6. Attacker runs code in the admin's browser

A logged-in user of AdminNeo's SQLite mode can write a file containing PHP code into the website folder, then run commands on the server through a web address. This can take over the server.

1. How it works:
2. Authenticated user
3. ATTACH blocked
4. VACUUM INTO runs
5. PHP shell in web root
6. Attacker runs commands on the server

If you run MoLing's network mode and open a malicious website, that site can quietly send commands to MoLing on your computer, which may read or change your files or run programs. Anyone on the internet who lures you to the page can do this

1. How it works:
2. Attacker builds page
3. Victim visits page
4. sessionId leaked
5. Forged tool calls
6. Attacker runs actions on victim machine

A user who has a login to the ThingLinks IoT platform can submit a small program that the server then runs itself. That lets them take control of the server, not just the platform's own features.

1. How it works:
2. Attacker logs in
3. Submits Groovy script
4. Server compiles script
5. Code runs on server
6. Attacker controls the server

Anyone on the internet can send a specially crafted request to the platform and change the time-series sensor readings it stores, without logging in. Attackers could insert fake readings or overwrite real ones.

1. How it works:
2. Remote attacker
3. Crafted request
4. TDS mapper
5. TDengine database
6. Sensor data inserted or overwritten

A library that checks who a secure connection is really talking to can be fooled by a special certificate, letting an attacker in the middle pose as the real server. Normal setups are protected, but some are not.

1. How it works:
2. Attacker in the middle
3. Crafted certificate
4. Hostname check passes
5. Impersonation succeeds
6. Attacker impersonates a TLS peer

A tool that uploads Python packages to PyPI was shipping with a certificate that could make it trust connections to fake servers. Old versions could be tricked into sending data to the wrong place.

A flaw lets an outsider send a specially crafted web request to this license server and run their own code on it with full system control. Anyone who can reach the server over the network could potentially exploit it.

1. How it works:
2. Attacker sends request
3. Request reaches server
4. Buffer overflows
5. Code runs as SYSTEM
6. Attacker controls the Windows server

Kargo is a tool that moves software builds through deployment stages. A user who was allowed to manage roles in a project could give themselves, or others, more power than they were supposed to have, including reading secrets.

1. How it works:
2. Delegated user
3. Crafts role change
4. API writes change
5. Gains project admin
6. Attacker gains Project-administrator access

Some apps that build database queries with this Clojure library can be tricked by crafted user input into running extra database commands. Attackers could read, change or delete data, depending on what the database account is allowed to do.

1. How it works:
2. Attacker sends input
3. App passes input to keyword
4. Unchecked SQL is generated
5. Database runs the query
6. Attacker runs commands on the database

A logged-in user can add a podcast whose episode link points at the server's own internal services. The server fetches that link for them and saves the response, so they can read data they should never see.

1. How it works:
2. Logged-in user
3. Add malicious feed
4. Server fetches URL
5. Response saved
6. Internal data exposed to a low-privilege user

A flaw in pgAdmin's data export tool can let a logged-in database user sneak extra commands past its checks. Those commands run on the computer where pgAdmin is installed, not inside the database.

1. How it works:
2. Database user
3. Crafted export query
4. Quote check fooled
5. psql runs TO PROGRAM
6. Attacker runs commands on pgAdmin host

pgAdmin is a web tool for managing databases. A flaw let anyone on the network try unlimited passwords against accounts, including the administrator, because the built-in lockout after failed logins could be sidestepped.

1. How it works:
2. Attacker sends requests
3. Hits unprotected login views
4. Guesses passwords freely
5. Account is taken over
6. Attacker gains administrator access

A flaw in the LeadSnap plugin lets an outside visitor send specially crafted data that makes the website run commands it should not run. Anyone who can reach the site can try it, with no password needed.

1. How it works:
2. Attacker
3. Public site
4. Object injection
5. Code execution
6. Attacker controls the website server

Anyone on the internet can send specially crafted data to this WordPress plugin and potentially run code on the site without logging in. Site owners using the affected version should update right away.

Anyone on the internet can send specially crafted input to the Transliterator component and make the website's database run commands the site owner never intended. This could expose or change stored data without logging in.

1. How it works:
2. Anonymous attacker
3. Crafted request
4. Transliterator flaw
5. SQL executed
6. Attacker reads or alters database data

A flaw lets an attacker send specially crafted data to the Royal Event theme that the website then trusts and processes. This can let the attacker take control of the website.

A flaw in the Widget Options plugin could let an outside attacker run their own commands on the website's server. That can mean taking over the site or stealing its data.

Anyone on the internet can, without logging in, gain higher access rights on affected WordPress sites. This could let an attacker take over parts or all of the site.

Hackers got into the online shop of the clothing retailer Resolve and took customers' credit or debit card numbers. Anyone who shopped there may need to watch their card statements.

Visual Studio does not properly check whether a server's security certificate is genuine. An attacker on the same network could pretend to be a trusted server.

A remote visitor can send one specially crafted request that makes the AdminNeo login and pages fail with server errors for all users for up to a day. Nothing is stolen, but the tool becomes unusable until the bad data is cleared or the sof

1. How it works:
2. Attacker
3. Cache poisoned
4. Page load
5. TypeError
6. AdminNeo returns HTTP 500 to all users

Programs that show translated text can be tricked into loading a translation file from a folder chosen by an attacker. A crafted file can crash the program or run attacker code with the program's permissions.

1. How it works:
2. Attacker sets env
3. Program runs
4. Loads .mo file
5. Malicious catalog
6. Program crashes or attacker runs code

Anyone with a Flowise login can slip code past the tool's safety limits and make the server run commands of their choosing. That can give them control of the machine running Flowise.

1. How it works:
2. Logged-in user
3. Custom function endpoint
4. Mammoth file write
5. vm2 sandbox escape
6. Attacker runs commands on the server

A background helper in JetBrains software could be tricked into trusting fake security certificates. This could let an attacker pose as a trusted JetBrains server and send harmful updates or data.

1. How it works:
2. Attacker forges certificate
3. Traffic redirected
4. jetbrainsd trusts it
5. Malicious content accepted
6. Attacker impersonates JetBrains services