A flaw in Ivanti's VPN gateway lets someone who already has a login place files of their choosing onto the server. Attackers are using it in real attacks, and it is chained with other flaws.

1. How it works:
2. Attacker holds a login
3. Predictable identifier abused
4. Malicious file uploaded
5. Chained with other flaws
6. Attacker places files on VPN server

Ivanti Connect Secure is a VPN gateway that lets staff connect remotely. A flaw lets someone with a low-level login gain full administrator control of the device, and attackers are already using it.

1. How it works:
2. Attacker has low-level login
3. Missing authentication check
4. Broker trusts bad config
5. Privileges escalated to root
6. Attacker gains root on VPN device

A website's login session handling can be tricked by a specially crafted cookie into sending extra instructions to its cache server. This can let an attacker run commands the site never intended.

1. How it works:
2. Attacker crafts cookie
3. Request sent to site
4. CHI store builds cache key
5. Memcached reads extra commands
6. Attacker sends commands to cache server

Prefab UI's Generative UI feature runs code meant to be isolated, but the isolation can be bypassed. Someone who can send code to it can read and change files on the server and keep running code there.

1. How it works:
2. Attacker sends code
3. FastMCP server
4. Pyodide sandbox
5. Server files
6. Attacker runs code on the server

A customer with a normal login can reach files that belong to other customers on the same server, and can read and change them. The flaw comes from a missing check on which storage volume a deployment may attach.

1. How it works:
2. Tenant with token
3. Crafted volume ID
4. Path escapes root
5. Read-write mount
6. Attacker reads and writes other tenants' data

A tenant with a sandbox can use the file feature to read, change, or delete files on the shared server running their sandbox, including other customers' files. Attackers may be able to take over the whole cluster.

1. How it works:
2. Tenant holds sandbox
3. Sends crafted file path
4. Worker joins path unsafely
5. Host file accessed as root
6. Attacker may gain cluster-admin control

A customer who submits a container image build can break out of the build's sandbox and reach files on the build machine. Those files include the machine's access token, which could be used against the rest of the system.

1. How it works:
2. Tenant submits image build
3. Shell command becomes RUN step
4. Build reaches worker filesystem
5. Worker credentials exposed
6. Tenant reads worker's service account token

A data-parsing library used by some Java programs can be tricked into going around in an endless loop while reading malicious input, which can freeze or crash the program. Upgrading the library fixes it.

1. How it works:
2. Attacker sends crafted data
3. Request reaches service
4. skip() recurses without limit
5. Service stalls or crashes
6. Java service becomes unavailable

The mtools tool, which reads and writes files on DOS-style (FAT) disks, can write data past the end of a memory area. This memory error can make the program misbehave.

A login library could let someone sign in as another person. An attacker can edit a form field during Apple login so the app believes it is a different user.

1. How it works:
2. Attacker signs in
3. Attacker edits user field
4. Library merges data
5. App trusts wrong identity
6. Attacker logs in as another user

Anyone on the network can claim the administrator account of this Okta helper tool before the real owner finishes setup. The attacker then controls the tool and the Okta data it reads.

1. How it works:
2. Attacker scans network
3. Calls setup endpoint
4. Admin account created
5. Okta data accessed
6. Attacker controls the admin account

A specially built, broken PDF file can make the pypdf Python library freeze instead of finishing its work. Anything that opens such a file can get stuck waiting, which can block a service.

1. How it works:
2. Attacker crafts PDF
3. App opens the file
4. pypdf searches trailer
5. Thread blocks forever
6. Processing thread hangs indefinitely

A small, specially crafted zip or tar.gz file uploaded as a pipeline can expand into a huge amount of data in the server's memory, which can slow or crash the service. Uploads can be processed before permission checks, so unauthorized calle

1. How it works:
2. Crafted archive
3. Upload request
4. Server decompresses
5. Memory exhausted
6. API server service is interrupted

Someone who can reach the Kubeflow Pipelines backend and knows a run ID can read that run's logs, which may contain private data or passwords. Live logs can also be pulled from an unrelated pod in the same namespace.

1. How it works:
2. Attacker with access
3. Knows a run ID
4. Log request sent
5. Logs returned
6. Attacker reads another run's logs

A specially crafted PDF file can make the pypdf Python library use a huge amount of memory, which can slow down or crash the program reading it. Opening untrusted PDFs is the main risk.

A specially crafted PDF file can make the pypdf Python library get stuck in an endless loop, freezing the program that processes it. Nothing in the material says data is stolen or systems are taken over.

1. How it works:
2. Attacker crafts PDF
3. Application processes file
4. pypdf traverses cycle
5. Process hangs
6. Processing hangs, service becomes unavailable

A specially crafted upload with a very long header value can make a Node.js server stop responding for a long time. Anyone who can send a request to the server can do this without logging in.

1. How it works:
2. Attacker sends upload
3. Request reaches server
4. Header parsed
5. Event loop blocked
6. Server stops responding to users

A single crafted request with a very long run of spaces can make a Node.js server stop responding for several seconds. Other users' requests wait during that time.

1. How it works:
2. Attacker sends request
3. Route validates field
4. Regex backtracks
5. Event loop blocked
6. Server stops responding for seconds

A specially crafted glob pattern (a file-matching pattern) can make the minimatch library use huge amounts of CPU and memory while it prepares the pattern, which can slow down or crash the app using it.

1. How it works:
2. Crafted pattern
3. Pattern compiled
4. Expansion loop
5. Pairwise comparison
6. Service slows down or crashes

A specially crafted, broken PDF file can make the pypdf Python library use huge amounts of memory while it reads the file. This can slow down or crash the program that opens it.

1. How it works:
2. Attacker sends PDF
3. App parses file
4. Errors balloon
5. Memory exhausted
6. Service memory exhaustion, possible crash

A specially crafted PDF file can make the pypdf Python library run extremely slowly when it reads page labels. This can tie up a program or server for a long time.

1. How it works:
2. Crafted PDF
3. App reads labels
4. Repeated scans
5. Slow processing
6. Program or server becomes unresponsive

A client holding its own valid access token could read, change, or delete a different client's registration. Changing redirect addresses could let an attacker steal login codes or tokens.

1. How it works:
2. Attacker holds token
3. Sends request
4. Missing ownership check
5. Registration changed
6. Other clients' registrations are hijacked or removed

A specially crafted encrypted PDF file can make the pypdf Python library slow down a lot or use up a lot of memory when it reads the page count. This can freeze or crash a program that opens untrusted PDF files.

1. How it works:
2. Attacker crafts PDF
3. PDF reaches application
4. App reads page count
5. Excessive work
6. Service slows down or crashes

A specially crafted PDF file can make the pypdf Python library use up huge amounts of memory and slow or crash the program that opens it. Opening an untrusted PDF is the main risk.

1. How it works:
2. Attacker crafts PDF
3. PDF is delivered
4. pypdf opens file
5. Memory exhausted
6. Service slows down or crashes

A crafted number inside data sent to the pyasn1 library can make a program freeze or run very slowly while it reads that data. Someone could use this to keep a server busy, which can make it unresponsive to other users.

1. How it works:
2. Crafted input
3. App decodes data
4. CPU busy
5. Service slows
6. Availability loss from CPU exhaustion

pyasn1 is a Python library that reads a common data format used in certificates and security messages. A specially built input made of many small pieces can make it take a very long time to read, which can freeze the program that is reading

1. How it works:
2. Attacker crafts input
3. Input reaches app
4. pyasn1 decodes it
5. CPU exhausted
6. Decoding thread stalls, denial of service

Someone can send a specially built block of data that makes a program using pyasn1 spend a lot of processing time on it. Enough of these can tie up the server's CPU and slow or stop the service.

1. How it works:
2. Attacker sends data
3. Request reaches app
4. pyasn1 decodes
5. CPU saturates
6. Service slows down or stops responding

A specially crafted small piece of data can make programs that read certain security-related data formats use a lot of processor time. This can slow down or stall the service reading it.

1. How it works:
2. Attacker sends crafted data
3. Data reaches the service
4. Decoder slows down
5. CPU is exhausted
6. Service becomes slow or unavailable

Someone can send a specially crafted certificate or key text that makes a Node.js app hang for a long time while it tries to read it. This is a denial-of-service issue: the app stops responding but no data is stolen.

1. How it works:
2. Attacker sends PEM
3. App parses input
4. Event loop blocked
5. Service unresponsive
6. Application becomes unresponsive (denial of service)

A flaw in the node-forge JavaScript library can make it trust a certificate that should not be trusted as a certificate authority. A holder of such a certificate could then create fake certificates for any website, which can fool apps into

1. How it works:
2. Obtains certificate
3. Forges extension
4. Verification passes
5. Impersonation
6. Attacker impersonates servers or clients

A remote computer can send a few specially crafted bytes to a Node.js program using this TLS library, which makes the whole program crash. No login is needed to trigger it.

1. How it works:
2. Remote peer
3. Split handshake
4. process() call
5. Uncaught TypeError
6. Node.js process crashes

A remote computer that connects to your app can send one burst of many tiny messages and make the program crash. The crash stops the service until it restarts.

1. How it works:
2. Malicious peer
3. Burst of records
4. node-forge recursion
5. Stack overflow
6. Service goes down until restarted

Attackers can craft a fake certificate file (PKCS#12) that opens with any password, or decrypt a private key without knowing its password. This can let them tamper with files or read keys they should not see.

1. How it works:
2. Attacker crafts file
3. node-forge derives key
4. App accepts file
5. Forged content trusted
6. Attacker bypasses password checks

When this library uploads a file to a container registry, it can accidentally send the login token or password to another website if the registry points it there. Someone running a hostile or hacked registry could collect those credentials.

1. How it works:
2. Hostile registry
3. Upload redirect
4. Client PUTs blob
5. Credentials captured
6. Attacker obtains registry credentials

A popular Node.js library can accidentally send your custom secret header (like an API key) to a different website when the server redirects. Built-in login headers stay protected; only custom ones are at risk.

1. How it works:
2. Attacker controls endpoint
3. App sends request
4. Library follows redirect
5. Header forwarded
6. Attacker receives your custom API key

A short, specially crafted GraphQL request can make the server keep growing its memory use, and each repeated request adds more. A busy server can eventually run out of memory and crash, but no data is stolen or changed.

1. How it works:
2. Attacker
3. Validation runs
4. Shared error reused
5. Memory grows
6. Worker runs out of memory and crashes

Keys added to the SSH agent with the 'ask me first' option (ssh-add -c) can be used without asking the user. Anyone who can reach the agent socket, including a remote host you forwarded your agent to, may sign in as you.

1. How it works:
2. Process with socket access
3. Requests a signature
4. Agent skips confirmation
5. Never prompted
6. Attacker signs or logs in as the user

A client app with limited permissions can sometimes pretend to be a more powerful app during token requests. This can let it obtain access it should not have.

1. How it works:
2. Low-privilege client
3. Token request
4. OAuthlib authenticates
5. Wrong identity checked
6. Attacker gets unauthorized access tokens

Someone who can reach the server without a login can trick it into handing over its secret signing key. With that key they can make themselves an admin and run commands on the machine.

1. How it works:
2. Anonymous attacker
3. Traversal request
4. Secret key read
5. Admin token forged
6. Attacker controls the server

Someone can send a specially crafted ICO image file to imgproxy and make the server crash or, in the worst case, let the attacker run their own code on it. No login is needed to send the image.

1. How it works:
2. Attacker sends ICO
3. imgproxy reads header
4. Tiny buffer allocated
5. Heap overwritten
6. Server crashes or attacker gains code execution

A malformed ICO image file can make the imgproxy image service crash while processing it. Crashes can take the service offline for everyone who uses it.

1. How it works:
2. Crafted ICO file
3. imgproxy loads image
4. Heap corrupted
5. Worker aborts
6. Image worker crashes, service disrupted

A specially crafted tiny icon file can make imgproxy try to reserve about 4GB of memory. Repeated requests can crash the service or slow down the server.

1. How it works:
2. Attacker sends file
3. imgproxy parses ICO
4. Huge allocation
5. Memory exhausted
6. Repeatable memory exhaustion and denial of service

A logged-in user of AdminNeo's SQLite mode can make the server delete almost any file it has permission to remove, not just database files. This can break the site or wipe important data.

1. How it works:
2. Logged-in user
3. Drop request
4. unlink() call
5. File deleted
6. Arbitrary server files get deleted

Someone who can add a special header to requests can trick your browser into sending your AdminNeo login session and database key to a different website. That can let them take over your admin session and read saved database passwords.

1. How it works:
2. Attacker adds header
3. AdminNeo builds cookie
4. Browser accepts cookie
5. Session cookies sent out
6. Attacker gets session and database key

If someone tricks you into connecting AdminNeo to a fake database server, that server can send back a specially crafted reply that makes your browser run code chosen by the attacker. This can happen without you logging in to anything.

1. How it works:
2. Attacker sets up server
3. Admin connects
4. Version string inserted
5. Script runs
6. Attacker runs code in the admin's browser

A logged-in user of AdminNeo's SQLite mode can write a file containing PHP code into the website folder, then run commands on the server through a web address. This can take over the server.

1. How it works:
2. Authenticated user
3. ATTACH blocked
4. VACUUM INTO runs
5. PHP shell in web root
6. Attacker runs commands on the server

If you run MoLing's network mode and open a malicious website, that site can quietly send commands to MoLing on your computer, which may read or change your files or run programs. Anyone on the internet who lures you to the page can do this

1. How it works:
2. Attacker builds page
3. Victim visits page
4. sessionId leaked
5. Forged tool calls
6. Attacker runs actions on victim machine

A user who has a login to the ThingLinks IoT platform can submit a small program that the server then runs itself. That lets them take control of the server, not just the platform's own features.

1. How it works:
2. Attacker logs in
3. Submits Groovy script
4. Server compiles script
5. Code runs on server
6. Attacker controls the server

Anyone on the internet can send a specially crafted request to the platform and change the time-series sensor readings it stores, without logging in. Attackers could insert fake readings or overwrite real ones.

1. How it works:
2. Remote attacker
3. Crafted request
4. TDS mapper
5. TDengine database
6. Sensor data inserted or overwritten

A library that checks who a secure connection is really talking to can be fooled by a special certificate, letting an attacker in the middle pose as the real server. Normal setups are protected, but some are not.

1. How it works:
2. Attacker in the middle
3. Crafted certificate
4. Hostname check passes
5. Impersonation succeeds
6. Attacker impersonates a TLS peer

A tool that uploads Python packages to PyPI was shipping with a certificate that could make it trust connections to fake servers. Old versions could be tricked into sending data to the wrong place.

A flaw lets an outsider send a specially crafted web request to this license server and run their own code on it with full system control. Anyone who can reach the server over the network could potentially exploit it.

1. How it works:
2. Attacker sends request
3. Request reaches server
4. Buffer overflows
5. Code runs as SYSTEM
6. Attacker controls the Windows server

Kargo is a tool that moves software builds through deployment stages. A user who was allowed to manage roles in a project could give themselves, or others, more power than they were supposed to have, including reading secrets.

1. How it works:
2. Delegated user
3. Crafts role change
4. API writes change
5. Gains project admin
6. Attacker gains Project-administrator access

Some apps that build database queries with this Clojure library can be tricked by crafted user input into running extra database commands. Attackers could read, change or delete data, depending on what the database account is allowed to do.

1. How it works:
2. Attacker sends input
3. App passes input to keyword
4. Unchecked SQL is generated
5. Database runs the query
6. Attacker runs commands on the database

A logged-in user can add a podcast whose episode link points at the server's own internal services. The server fetches that link for them and saves the response, so they can read data they should never see.

1. How it works:
2. Logged-in user
3. Add malicious feed
4. Server fetches URL
5. Response saved
6. Internal data exposed to a low-privilege user

A flaw in pgAdmin's data export tool can let a logged-in database user sneak extra commands past its checks. Those commands run on the computer where pgAdmin is installed, not inside the database.

1. How it works:
2. Database user
3. Crafted export query
4. Quote check fooled
5. psql runs TO PROGRAM
6. Attacker runs commands on pgAdmin host

pgAdmin is a web tool for managing databases. A flaw let anyone on the network try unlimited passwords against accounts, including the administrator, because the built-in lockout after failed logins could be sidestepped.

1. How it works:
2. Attacker sends requests
3. Hits unprotected login views
4. Guesses passwords freely
5. Account is taken over
6. Attacker gains administrator access

A single web request with a very long, malformed language header can make the server spend a lot of processing power on it. Repeating that request can make the site unresponsive for everyone.

1. How it works:
2. Attacker
3. Internet
4. Daptin middleware
5. CPU exhausted
6. Server becomes slow or unresponsive

A remote visitor can send one specially crafted request that makes the AdminNeo login and pages fail with server errors for all users for up to a day. Nothing is stolen, but the tool becomes unusable until the bad data is cleared or the sof

1. How it works:
2. Attacker
3. Cache poisoned
4. Page load
5. TypeError
6. AdminNeo returns HTTP 500 to all users

A background helper in JetBrains software could be tricked into trusting fake security certificates. This could let an attacker pose as a trusted JetBrains server and send harmful updates or data.

1. How it works:
2. Attacker forges certificate
3. Traffic redirected
4. jetbrainsd trusts it
5. Malicious content accepted
6. Attacker impersonates JetBrains services

A Perl library for taking GoCardless direct debit payments can be tricked into charging someone else's bank mandate. An attacker who learns a payment redirect ID can use it to create payments.

1. How it works:
2. Attacker gets flow ID
3. Module confirms flow
4. Payment created
5. Repeat calls work
6. Unauthorized payments charged to victim's mandate

If the app's webhook secret is blank, anyone on the internet can send fake payment notices that the app will believe came from GoCardless. This can make the app record payments or changes that never happened.

1. How it works:
2. Attacker crafts webhook
3. Sends to webhook endpoint
4. Library checks signature
5. Forged event processed
6. Fake payment events are accepted as genuine

A specially crafted web request sent to a webhook receiver can make the program run out of memory and stop working. The attacker does not need a valid signature for the request to cause this.

1. How it works:
2. Attacker
3. Webhook endpoint
4. Legacy verification
5. Memory grows
6. Receiving process runs out of memory

A small web server for Perl can send extra data in replies to some requests. This can mix up responses on connections that stay open, so a visitor could receive another request's reply.

1. How it works:
2. Client sends HEAD
3. Starlet replies
4. Connection reused
5. Next response mixed
6. Responses on shared connections get desynchronized

A specially crafted web request can make the Starlet web server spend a lot of CPU time on one request, slowing or freezing that worker. An attacker can do this with a single request, without logging in.

1. How it works:
2. Attacker
3. Chunk-size line
4. Regex engine
5. Worker stalled
6. Worker is tied up, service degrades

A single crafted web request that claims a huge body size can make the server's worker process run out of memory and exit. Repeating it keeps the service down or restarting.

1. How it works:
2. Attacker sends request
3. Starlet reads body
4. Buffer allocated
5. Worker crashes
6. Worker restarts, service disrupted

Some Bazarr settings pages can be changed by anyone who can reach the app over the network, without signing in. An outsider could cut off the Plex link, change the API key, or send the app's Plex token to a server they control.

1. How it works:
2. Anonymous attacker
3. Reaches web interface
4. Calls Plex endpoints
5. Changes config
6. Integration disabled or credentials exposed

A flaw in LXD, a tool for running virtual machines and containers on servers, lets an outsider pretend to be a trusted admin. This can give them control of the whole cluster and every virtual machine on it.

1. How it works:
2. Outside attacker
3. Crafted certificate
4. LXD accepts it
5. Trusted client access
6. Attacker controls the cluster and its VMs

A flaw in a component that checks who is allowed to do what in OpenStack cloud software could let a restricted login gain more power than it was given. Someone holding a limited application credential might be able to do things they should

1. How it works:
2. Restricted credential holder
3. Crafted request
4. Middleware check
5. Protected API
6. Restricted credential gains elevated privileges

A bug in WordPress itself could let an outsider take control of a website without logging in. Attackers have started trying to use it within hours of the fix being released.

1. How it works:
2. Attacker scans sites
3. Sends crafted requests
4. Server runs attacker code
5. Data and site at risk
6. Attacker gains control of the site

A logged-in attacker could send specially crafted data that makes the service run their own commands. Google has already fixed this, so customers do not need to do anything.

A logged-in admin or analyst can upload a report with a specially crafted file name that tricks the server into saving the file somewhere else on the system, including places it should never reach. This can overwrite important files and bre

1. How it works:
2. Logged-in analyst
3. Crafted upload
4. Unsafe path join
5. File written
6. Host files overwritten, application disrupted

The admin template ships with a built-in default key used to sign login tokens. If the site still uses that default, an attacker can make their own login tokens and act as any user, including administrators.

1. How it works:
2. Attacker finds app
3. Forges a token
4. Sends token to API
5. Server accepts it
6. Attacker takes over accounts and data

Anyone who can reach the CoPilot server can open cloud security reports without logging in. During a Google Cloud scan, the uploaded Google account key can also be downloaded by strangers, letting them act as that account in your cloud.

1. How it works:
2. Anonymous visitor
3. Requests file path
4. Unauthenticated mount
5. GCP key downloaded
6. Attacker reads reports and controls the GCP account

Anyone who knows a built-in default password can skip the login and send commands to security tools, like making endpoints disruptive or forging alerts. The default is public because it ships in the sample settings file.

1. How it works:
2. Attacker
3. Webhook call
4. CoPilot
5. Wazuh manager
6. Attacker disrupts endpoints and defenses

A user can hide a malicious script inside an alert comment. When a security analyst or admin opens that alert, the script runs in their browser and can steal their login tokens, letting an attacker act as them.

1. How it works:
2. Customer user
3. Portal stores comment
4. Analyst opens alert
5. Tokens stolen
6. Attacker takes over privileged account

Anyone who knows a secret password that ships with MuseBot can fake a login as the administrator, without needing a password. From there they can read private data and shut down the bots.

1. How it works:
2. Attacker finds default key
3. Forges session cookie
4. MuseBot accepts cookie
5. Admin access gained
6. Attacker takes over as administrator

Any logged-in administrator of this website software can see and replace the login keys of other administrators. That lets one admin take over another admin's access to the site's automated tools.

A weakness in the password reset page of the Vvveb website builder could let someone take over an account without knowing its password. Updating the software closes the hole.

An attacker can send one small request containing many fake recipients, forcing the server to do heavy private-key math for each one. Enough of these requests can slow or freeze the service.

1. How it works:
2. Attacker sends JWE
3. App calls decrypt_json
4. RSA decrypt per recipient
5. CPU exhausted
6. Service becomes unavailable from CPU exhaustion

If you open or run Nx in a project someone else controls, a booby-trapped setting in its nx.json file can make your computer run hidden commands as you. Updating Nx closes this hole.

1. How it works:
2. Malicious author
3. Hostile repository
4. Run nx command
5. Shell injection
6. Attacker commands run as the victim

Anyone on the internet can ask the CallBackery web app to show the documentation of files on the server, and the app does not check whether the request is allowed. Because of a path trick ("..::"), this can reach files well outside the app

1. How it works:
2. Attacker sends request
3. Request reaches app
4. Path is built unchecked
5. File is read
6. Attacker reads arbitrary server files

Someone who already has a login on the same machine could gain higher rights than they should. Attackers who reach a low-privilege account can use this to take full control of that system.

If you connect to a computer that has been hacked or set up by an attacker, that computer can crash your TeamViewer app or, depending on your system, run its own code on your machine. Only the person who starts the remote session is exposed

1. How it works:
2. Attacker sets up host
3. You start a session
4. Malicious screen data
5. Viewer overflows
6. Viewer crashes or attacker runs code

Attackers can reach store pages and data they should not be able to see or change, such as orders. Attacks are already happening against online shops.

1. How it works:
2. Attacker
3. Direct request
4. Missing check
5. Store data
6. Attacker reads or alters store data

A Perl library that reads Excel files can be tricked by a specially built spreadsheet into running hidden instructions on the computer that opens it. Only programs using this library are at risk.

1. How it works:
2. Attacker crafts file
3. File reaches app
4. Parser runs
5. Eval executes code
6. Attacker runs code on the system

Attackers could sneak malicious code into WordPress sites, which may let them run code on the server, steal visitor data or take over parts of the site. Updating closes these gaps.

1. How it works:
2. Attacker submits payload
3. WordPress stores it
4. Visitor or admin loads page
5. Data exposed or changed
6. Attacker gains access to site data

A bug in how Chrome handles audio and video streams can let a malicious web page read parts of the browser's protected memory. Updating Chrome closes this hole.

1. How it works:
2. Attacker builds page
3. User visits page
4. MediaStream bug triggers
5. Sandbox memory read
6. Sensitive browser memory exposed to attacker

A weakness in how Chrome manages memory when it handles files can be abused by a malicious web page. Someone could trick you into visiting that page and run code on your computer inside Chrome's protective sandbox.

1. How it works:
2. Attacker builds page
3. Victim opens page
4. Memory misused
5. Code runs in sandbox
6. Attacker runs code inside Chrome's sandbox

A flaw in Chrome's Autofill feature (the part that fills in forms for you) can let a malicious web page run harmful code on your computer. Updating Chrome closes the hole.

1. How it works:
2. Attacker builds page
3. User visits page
4. Autofill memory flaw
5. Code runs
6. Attacker runs code in the browser sandbox

A bug in Chrome's browser storage lets a malicious web page read parts of the computer's memory. Updating Chrome closes the hole.

1. How it works:
2. Attacker
3. Victim visits page
4. CacheStorage bug
5. Memory read
6. Attacker reads browser memory data

A bug in how Chrome handles files can be abused by a malicious web page to run harmful code on your computer. Updating Chrome closes the hole.

1. How it works:
2. Attacker builds page
3. User visits page
4. Chrome FileSystem bug
5. Code runs in sandbox
6. Attacker runs code inside browser sandbox

A customer-level user can upload a report template that the server later runs as code. That can let them take over the server and read data from every customer.

1. How it works:
2. Customer user
3. Template stored
4. Report generated
5. Template executed
6. Attacker controls the server

Docat has a file upload feature that does not check what files are accepted. An attacker could upload files that overwrite settings or run malicious code on the server.

1. How it works:
2. Attacker sends file
3. No file checks
4. File written to server
5. Code or script runs
6. Attacker gains control or steals user cookies

A flaw let a logged-in administrator break out of the sandbox that limits scripts, and run commands directly on the underlying server. ServiceNow has already fixed it on hosted instances.

1. How it works:
2. Admin account
3. Sandbox bypass
4. Host code execution
5. Further access
6. Attacker runs code on the host server

A flaw in the Botan encryption library can let an attacker corrupt a program's memory when the program lets outside users choose the encryption settings. Memory corruption can crash the program or, in some cases, let an attacker take contro

1. How it works:
2. Attacker supplies parameters
3. App passes to Botan C API
4. Block size truncated
5. Buffer too small
6. Memory corruption in the application

A build check in the typing-test project's automation could let an outsider run their own code with the project's own access key. That key could be used to change the project's code or its pull requests and issues.

1. How it works:
2. Outside contributor
3. Format label applied
4. Fork code runs
5. Token exposed
6. Attacker gains repository write access

A bug in how Linux handles network connections can let an outsider with no password take full control of a server. Attackers can reach it over the internet if the server accepts connections.

1. How it works:
2. Remote attacker
3. Crafted SYN packets
4. Freed memory reused
5. Code runs in kernel
6. Attacker runs commands as root

A remote client can open one connection and repeatedly send requests it immediately cancels, forcing the server to do full work for each and using up its CPU. This can make the server slow or unresponsive for everyone.

1. How it works:
2. Attacker opens connection
3. Sends request then reset
4. Server renders request
5. Reset frees stream
6. Server CPU exhausted, service denied

A small library that decodes web addresses can be tricked into taking a very long time on specially crafted text. While it works, the whole Node.js server stops answering other visitors.

1. How it works:
2. Attacker sends payload
3. Request reaches server
4. Native decode throws
5. Quadratic replacement loop
6. Server stops responding to all clients

A request signed in for one Shopify store could carry a different store's name in its address, and the app might treat it as the wrong store. That could expose another store's data.

1. How it works:
2. Attacker with one shop's token
3. Crafted request
4. Context resolved wrongly
5. Wrong shop's data
6. Attacker reads or changes another shop's data

Anyone allowed to create ACME challenge objects in their own namespace can make cert-manager use the cluster's DNS provider credentials for settings the admin never approved. With acme-dns, the secret login details can be sent to a server t

1. How it works:
2. Tenant user
3. Crafted Challenge
4. cert-manager controller
5. ClusterIssuer secret
6. Cluster DNS credentials exposed or misused

A specially crafted small ZIP file can make any program that extracts it crash immediately. Because the crash cannot be caught, the program stops and must be restarted, so repeated attacks can keep it down.

1. How it works:
2. Attacker
3. ZIP archive
4. Extraction
5. Process abort
6. Application process crashes and cannot recover

A specially crafted zip file can trick the program into saving files somewhere other than the folder it was meant to unpack into. On Windows, a single shortcut inside the archive is enough when the program runs with admin rights or Develope

1. How it works:
2. Attacker crafts archive
3. Archive is extracted
4. Lexical check passes
5. File written outside target
6. Attacker controls files outside extraction folder

A tiny specially crafted ZIP file can make an app built with the Rust zip library crash while extracting it. A crash can stop a file-processing service until it is restarted.

1. How it works:
2. Attacker crafts ZIP
3. App receives file
4. extract() is called
5. Memory reserve fails
6. Service crashes, denial of service

A user with admin rights on Keycloak (a login and identity system) could create a client with a booby-trapped web address. When someone clicks it, the code inside runs in the Keycloak site, potentially letting an attacker act as that user.

1. How it works:
2. Admin account abused
3. Malicious client registered
4. Victim clicks link
5. Script runs in Keycloak
6. Attacker runs code in the Keycloak origin

Keycloak is a login and access system. A flaw lets any signed-in user skip the access rules that normally block them from some pages, by putting a specific page address into the web request.

1. How it works:
2. Signed-in user
3. Crafted request
4. Policy check skipped
5. Protected resource
6. Unauthorized access to protected resources

Anyone on the internet can send requests through this plugin, and it forwards them to the chatbot backend using the site's own stored login. Attackers can therefore act as the server's account, even admin-level functions.

1. How it works:
2. Anonymous attacker
3. Volto proxy route
4. Server credentials added
5. Danswer API called
6. Attacker acts as the service account

If you run this PDF tool in HTTP mode, anyone who can reach its network port can use it without a password, and read PDF files on the machine. Setting an API key did not actually protect it.

1. How it works:
2. Remote client
3. HTTP /mcp endpoint
4. PDF tools run
5. Local PDFs read
6. Attacker reads PDFs without credentials

A malicious workflow file can run commands on the computer that runs it, as if the attacker were logged in there. Anyone who runs workflow files from untrusted sources is at risk.

1. How it works:
2. Attacker writes workflow
3. File reaches runner
4. PraisonAI runs it
5. os.system runs
6. Attacker runs commands on the host

A flaw in this file transfer server could let someone outside your company send commands that the server then runs on its own computer. Under certain settings, that could mean full control of the machine.

A bug in WS_FTP Server, a file transfer program, lets a limited admin reach parts of the server they should not see. In the worst case, this could let someone run their own code on the server.

1. How it works:
2. Delegated admin logs in
3. Path traversal request
4. Files outside scope reached
5. Code execution possible
6. Attacker may take control of the server

A flaw in this file transfer server lets an outsider type commands that the server then runs on its computer. Those commands can run with high-level permissions, so an attacker could take over the machine.

A limited admin account on the file transfer server could read or change files they were not supposed to touch. The flaw is a path trick that breaks out of the folders the admin is allowed to use.

A flaw in the WS_FTP file transfer server lets a limited administrator go beyond the permissions they were given. In the worst case, they could run commands with higher privileges and take over the whole server.

1. How it works:
2. Delegated admin
3. Admin interface
4. Scope exceeded
5. Command execution
6. Attacker gains full control of the server

A file transfer server can be tricked into giving sensitive data, including admin passwords, to someone who never logged in. An attacker could then take control of the server.

1. How it works:
2. Unauthenticated attacker
3. Reaches exposed server
4. Authentication bypassed
5. Admin credentials exposed
6. Attacker gains administrative access

A logged-in user can upload a specially crafted file that gets saved to a place on the server it should never reach. This can let the attacker run their own code on the server.

1. How it works:
2. Attacker logs in
3. Crafted file upload
4. File written outside storage
5. Code executed
6. Attacker controls the server

Some user accounts in ZITADEL have no password or passkey set yet. An attacker could set the first sign-in method on such an account and then log in as that user.

1. How it works:
2. Attacker starts
3. Forges cookie
4. Sets credential
5. Logs in
6. Attacker controls the user account

A flaw in P-Net, a networking library used in industrial devices, lets a specially crafted connection request write data past the memory it should stay within. This can crash the device or, in the worst case, let an attacker run their own c

1. How it works:
2. Attacker sends request
3. Request reaches device
4. Unchecked length used
5. Out-of-bounds write
6. Device crashes or attacker runs code

Jenkins is a tool that builds and deploys software automatically. Attackers could exploit several flaws to gain admin rights, run their own code, or read and change data.

Attackers could exploit several bugs in Google Chrome to run harmful code on your computer, gain extra access, or steal or change data. Updating Chrome closes these holes.

A logged-in user with certain roles can type special input into a time-zone setting and make the device run commands of their choosing. That can give them full control of the device.

1. How it works:
2. Logged-in user
3. Time-zone input
4. Shell command built
5. Commands executed
6. Attacker gains full control of the device

A logged-in user of the TRO600 device can get around network rules and reach services that should only be used from inside the device itself. This can expose private settings and data, or disrupt the device.

1. How it works:
2. Authenticated user
3. Port forwarding
4. Localhost-only services
5. Sensitive access
6. Restricted services exposed to attacker

Someone on the network without logging in could download files from the device, including configuration files and stored passwords. Those passwords could then be used to take control of the device.

1. How it works:
2. Unauthenticated attacker
3. Requests file path
4. Device returns file
5. Passwords exposed
6. Attacker gains sensitive data and credentials

A login helper used by Mendix apps can be tricked: someone who captures a valid single sign-on login message can reuse it to get into the application without a password. Updating the module closes this gap.

1. How it works:
2. Attacker captures login
3. Attacker replays response
4. App accepts replay
5. Unauthorized access
6. Attacker gains unauthorized application access

Several popular business programs from Adobe, Veeam and Juniper had serious security holes. Attackers could potentially run their own code on affected systems or gain higher access than they should.

A specially crafted message with extremely deep nesting can make the messaging library crash. Anything that reads such messages could stop working until restarted.

A library used to run encrypted connections can accept certificates it should reject, so an impostor server or client could slip past the security check. Updating the library closes this gap.

1. How it works:
2. Attacker obtains certificate
3. Attacker intercepts connection
4. Library accepts certificate
5. Traffic exposed
6. Attacker impersonates a trusted peer

A setting that should only pass plain text to a remote computer can instead be read as a command and run there. Someone who controls that text could make the remote machine run things they chose.

1. How it works:
2. Attacker supplies input
3. Airflow DAG runs
4. Value read as shell
5. Remote SSH host
6. Attacker runs commands on remote host

Old database backups of Axis Camera Station Pro can be copied and read offline, which could reveal the passwords it stores for your cameras. Anyone who gets those backup files could potentially log into your cameras.

1. How it works:
2. Attacker gets backup
3. Backup decrypted
4. Cameras exposed
5. Attacker gains access to camera credentials

Attackers are abusing recently patched PHP bugs to take control of servers and firewalls that are reachable from the internet. Some of these attacks have reached government-affiliated systems.

1. How it works:
2. Attacker scans
3. Exploits PHP2Shell
4. Gains shell access
5. Chains Fragnesia
6. Attacker controls the server as root

Anyone allowed to write or edit scripts in openEQUELLA can make the server run any command on the operating system. That can give them control of the server itself, not just the software.

1. How it works:
2. Script author
3. Malicious script
4. Command runs
5. Service account
6. Attacker controls the server

Websites that use this login library may accept a forged login message, letting an attacker sign in as someone else. Updating the library closes the gap.

1. How it works:
2. Attacker obtains a signed message
3. Elements are relocated
4. Signature check passes
5. Login as another user
6. Attacker signs in as an arbitrary user

Someone with no login could send a specially crafted pattern in a GitLab pipeline setting and run their own commands on the GitLab server. Attackers are already trying this, so unpatched servers need updating now.

1. How it works:
2. Attacker crafts pattern
3. Request reaches GitLab
4. Regex not validated
5. Code runs on server
6. Attacker runs code on GitLab server

On Windows, a crafted service name passed to this Node.js library can make it run extra PowerShell commands. Those commands run with the same rights as the Node.js app, so they could read, change, or break files it can reach.

1. How it works:
2. Crafted service name
3. App forwards input
4. Sanitizer misses quotes
5. PowerShell injected
6. Commands run with Node.js process rights

An outsider can send crafted traffic to the firewall and run commands with full administrator rights. The attack has to be repeated for a few minutes before it works, but the result is complete control of the device.

1. How it works:
2. Remote attacker
3. Repeated requests
4. Path traversal
5. Code execution
6. Attacker gains root control of the firewall

Attackers can trick the live-streaming feature into running their own commands on the web server, with no login needed. That can expose passwords and let them take over the site.

1. How it works:
2. Attacker
3. Unauthenticated request
4. Trusted fake session
5. Shell injection
6. Attacker runs commands on the server

Someone on the internet can send a crafted request to the setup page and run their own code on the web server, if the site's setup file is missing. That gives them control of the server.

1. How it works:
2. Attacker
3. Unauthenticated request
4. Config file written
5. Code executes
6. Attacker controls the web server

Anyone on the internet can download the server's log files without logging in. Those files contain a secret key that lets an attacker pretend to be an administrator and take full control of the server.

1. How it works:
2. Remote attacker
3. Request logs
4. Extract secret key
5. Forge admin token
6. Attacker gains full admin control

Attackers can sneak into the systems that manage a company's SD-WAN network without a password and gain admin rights. From there they can change how the network is set up and steal the keys that encrypt traffic.

1. How it works:
2. Unauthenticated attacker
3. Peering auth bypassed
4. Admin account obtained
5. NETCONF access
6. Attacker controls SD-WAN network and steals keys

A small crafted request can make a server run out of memory or freeze. No login is needed, so anyone on the internet can trigger it.

1. How it works:
2. Attacker sends request
3. App decodes input
4. Length is trusted
5. Memory or loop explodes
6. Server crashes or stops responding

A small specially crafted message sent to an app using this library can make the app stop responding. The app can freeze or run out of memory.

1. How it works:
2. Attacker sends payload
3. App deserializes input
4. Decoder loops forever
5. Event loop blocked
6. Service becomes unavailable

Seroval is a library that turns JavaScript values into text and back. A crafted input could trick it into calling a function the app did not intend to run, which could expose or change data.

1. How it works:
2. Attacker crafts payload
3. App calls fromJSON
4. Plugin value selected
5. Plugin on() invoked
6. Unintended plugin code runs

vLLM trusts the file type label on uploaded images and can be tricked into handing a disguised file to a helper program. On a server with an old, vulnerable Ghostscript, that can let an attacker run commands with vLLM's permissions.

1. How it works:
2. Attacker sends image
3. vLLM loads bytes
4. Pillow picks EPS
5. Ghostscript runs payload
6. Attacker runs commands on the server

Someone who can send requests to a vLLM server can craft a request that makes the server run their own code. It works even when the server's safety setting for unsafe data is off.

1. How it works:
2. Authenticated caller
3. Forged cache reference
4. Malicious bytes loaded
5. Attacker runs Python code on the server

A specially crafted phone-number input can make the server spend many seconds on one request, so it stops answering other users. Anyone can send such a request without logging in.

1. How it works:
2. Attacker
3. PhoneNumber input
4. Validation runs regex
5. Event loop blocked
6. Server process stalls for seconds

Under certain setups, a logged-in user could read, change, or delete another user's saved data in LangGraph. Only deployments using JavaScript or TypeScript custom login with namespace rewriting are affected.

1. How it works:
2. Ordinary user logs in
3. Namespace rewritten
4. Rewrite not applied
5. Other user's data reached
6. Attacker accesses another user's data

A text-matching library can be made to spend a very long time on a single input, which can freeze the server process while it works. An attacker only needs to send a moderately large text.

1. How it works:
2. Attacker sends text
3. App runs re2js match
4. Matcher rescans input
5. CPU pinned
6. Server worker freezes, service denied

If your server uses happy-dom to read HTML from untrusted sources, an attacker can make your server fetch internal or cloud-only web addresses and possibly see the replies. This can leak cloud access keys.

1. How it works:
2. Attacker supplies HTML
3. Server parses the HTML
4. Server sends HTTP request
5. Internal or cloud endpoint replies
6. Internal data or cloud credentials exposed

Vue I18n is a tool that shows text in different languages on websites. A flaw lets specially crafted text hidden inside an iframe run its own code on the page, which can expose user data or actions.

1. How it works:
2. Attacker supplies content
3. Translation rendered
4. Browser decodes srcdoc
5. Script runs in iframe
6. Attacker script runs on the site

If one shared connection is used for several users, a later user's request can be sent with the previous user's login token. The server may then treat the new request as coming from the earlier user.

1. How it works:
2. User A request
3. Shared executor
4. User B request
5. connection_init sent
6. User B acts as User A downstream

A Node.js program connecting to a server by a specially written IP address (with a leading zero) may trust a certificate meant for a different address. An attacker in the network path could then impersonate the server.

1. How it works:
2. Attacker on network path
3. Client connects by IP
4. Certificate checked wrongly
5. Impostor accepted
6. Client trusts an impostor server

A flaw in how Chrome draws web pages can be abused by a malicious website. Visiting that site could let an attacker run code on your computer inside the browser's protective sandbox.

1. How it works:
2. Attacker builds page
3. Victim opens page
4. Use-after-free triggered
5. Code runs in sandbox
6. Attacker runs code inside the browser sandbox

A harmful web page could make Chrome run attacker code without any download prompt. Updating Chrome closes the hole.

1. How it works:
2. Attacker builds page
3. Page is served
4. Browser mishandles memory
5. Code runs in sandbox
6. Code runs inside browser sandbox

A flaw in Chrome could let a malicious web page run its own code on your computer. Updating Chrome closes the hole.

1. How it works:
2. Attacker builds page
3. Page is hosted
4. User opens page
5. Code runs
6. Code runs outside browser sandbox

A specially crafted web page could make Chrome run an attacker's code. The browser's sandbox limits the damage, but the flaw is still serious, so update now.

1. How it works:
2. Attacker builds page
3. Victim visits page
4. FileAPI mishandles input
5. Code runs in sandbox
6. Attacker runs code inside the browser sandbox

A specially built web page could trick Chrome on Android into running an attacker's code outside its normal safety walls. Updating Chrome closes this gap.

1. How it works:
2. Attacker builds page
3. User opens page
4. UI input not validated
5. Code runs outside sandbox
6. Attacker runs code beyond browser sandbox

A bug in a core part of Windows lets someone who already has a login on the computer gain administrator-level control. Outsiders cannot use it alone, but it can be used after they get a foothold.

1. How it works:
2. Local user access
3. Trigger Win32k bug
4. Kernel code runs
5. Admin rights gained
6. Attacker controls the Windows machine

Attackers can reach hidden debug pages in this flat-file website system without logging in. They can read and overwrite site content, inject malicious scripts into pages that visitors and admins see, and fill up the server's disk.

1. How it works:
2. Attacker sends request
3. Debug script runs
4. Files read or written
5. Script planted in page
6. Site defaced or admin sessions stolen

Attackers can send a specially crafted request to a Cisco firewall's VPN login page and make it restart, cutting off network access. Attacks are already happening in the wild.

1. How it works:
2. Attacker sends request
3. Request reaches firewall
4. Logic error triggers
5. Firewall reloads
6. Firewall goes down, network access lost

If a web page shows a chart built from data an attacker can influence, a link in the chart's credits area can run hidden code when clicked. That code can act as the logged-in user of the website.

1. How it works:
2. Attacker supplies config
3. Grid renders credits link
4. User clicks credits link
5. Script runs in page origin
6. Attacker acts as the logged-in user

If an attacker can change the text used for table pagination labels, their code can run in the browser of anyone viewing that table. Upgrading the library closes this.

1. How it works:
2. Attacker supplies language text
3. Grid renders pagination
4. Handler runs in page
5. Page data exposed
6. Attacker runs script in the page

A chart dashboard tool could run hidden code in a web page if someone feeds it a crafted language setting. That code would act with the same access as the website itself.

1. How it works:
2. Attacker sets language
3. Edit mode renders label
4. Script executes
5. Session and data exposed
6. Attacker runs script in the page origin

If someone can put malicious text into the dashboard's language settings, a web page could run their hidden code when an editor opens the sidebar. This can let an attacker act as the logged-in user on that site.

1. How it works:
2. Attacker supplies text
3. Config stored
4. User opens sidebar
5. Script executes
6. Attacker runs code in the site

If someone can control the chart's settings, a click on the small credits text can run attacker code inside your web page. That code can act as the logged-in user on that site.

1. How it works:
2. Attacker
3. Chart built
4. User clicks
5. Script runs
6. Attacker runs script in the user's site session

A bug in the Linux operating system's core can let an attacker quietly change data that the system treats as trusted, and chained with other flaws it can give them full control of the server. Attackers are already using it.

1. How it works:
2. Attacker sends traffic
3. Kernel coalesces buffers
4. ESP decrypts in place
5. Webshell implanted
6. Attacker runs commands as root

A chart library bug lets specially crafted chart data change a shared JavaScript setting that every script on the web page reads. Attackers could use that to alter how the page behaves for everyone viewing it.

1. How it works:
2. Crafted chart data
3. Chart renders
4. Prototype polluted
5. Page scripts read it
6. Page-wide JavaScript behavior is altered

A crafted chart data file can slip special property names into the page's shared JavaScript objects, which can break how the page draws charts or make other scripts behave wrongly. No clicks are needed beyond viewing the chart.

1. How it works:
2. Crafted chart data
3. JSON parsed
4. Highcharts builds columns
5. Prototype polluted
6. Page-wide objects are tampered with

If someone can control the settings of a chart on your website, they can make a clickable breadcrumb button run their own code in your visitors' browsers. This happens only after a user drills down into the chart and interacts with that but

1. How it works:
2. Attacker supplies config
3. Chart renders breadcrumbs
4. User drills down
5. User hovers or clicks
6. Attacker script runs in the site's origin

If a dashboard's setup settings can be controlled by someone untrusted, they can make the page run their own code. The victim only needs to open the dashboard.

1. How it works:
2. Attacker edits config
3. Config reaches dashboard
4. Board renders
5. Options copied to page
6. Attacker script runs in the hosting page

If an attacker can change the settings of a Highcharts Grid table, they can make an icon run hidden code when a user hovers over or clicks it. That code runs with the same access as the web page.

1. How it works:
2. Attacker edits config
3. Custom icon injected
4. User hovers or clicks
5. Script runs in page
6. Attacker runs script in user's page

If a web page builds its data table from settings an attacker can influence, the attacker can make the table run hidden code in visitors' browsers. Hovering over, clicking, or editing a cell is enough to trigger it.

1. How it works:
2. Attacker injects config
3. Grid renders inputs
4. User hovers or edits
5. Script runs in page
6. Attacker runs script in victim's session

If a web page builds charts from data a user or attacker can influence, that data can carry hidden scripts. In Chromium browsers, those scripts can run when the user prints the chart.

1. How it works:
2. Injects markup
3. User opens page
4. User prints
5. Unsafe parsing
6. Attacker script runs in the page origin

Someone who can put text into a chart can hide a script link inside it. If a user opens the exported chart file and clicks that link, the script runs in their browser.

1. How it works:
2. Attacker
3. Chart output
4. Export or inline
5. User clicks link
6. Script runs in the user's document origin

A web app built with Echo can serve a file that a route-level access rule was meant to block, if the request spells the path with an encoded slash (%2F). The file is still inside the public folder, so nothing outside it is exposed.

1. How it works:
2. Crafted request
3. Router
4. Static handler
5. File served
6. Guarded static file is served anyway

A tool meant to block risky web addresses can be tricked into fetching internal-only services, such as a database admin page, when the address includes a port number or is written as an IPv6 address in brackets. Those internal responses cou

1. How it works:
2. Attacker sends URL
3. Sanitizer passes URL
4. Tool fetches URL
5. Internal service responds
6. Internal service responses reach the attacker

A tool meant to block risky file paths allows anything inside user home folders, so an attacker sending one web request could read a stored SSH key or cloud password file if the app uses the result.

1. How it works:
2. Attacker sends request
3. Sanitizer accepts path
4. App reads file
5. Secrets returned
6. Attacker reads private keys and credentials

Any Rucio user with a normal login can pretend to be the admin account by changing one request header. This lets them get links that read, overwrite, or delete files in the cloud storage Rucio manages.

1. How it works:
2. Low-privilege user
3. Forged header
4. Rucio server
5. Signed URL issued
6. Attacker controls arbitrary cloud objects

A web app built with Echo can accidentally forward a visitor's later requests straight to a backend server, skipping the app's own login and permission checks. Someone who can reach that proxy route could then reach backend pages they shoul

1. How it works:
2. Attacker sends upgrade
3. Echo opens raw tunnel
4. Upstream rejects upgrade
5. Later requests go direct
6. Echo route authorization is bypassed

A specially crafted web upload with a broken or missing separator can make a Perl web application slow down and tie up its processor. Enough of these requests can make the service unresponsive.

1. How it works:
2. Attacker sends request
3. Parser buffers data
4. Full rescan per chunk
5. CPU climbs
6. Worker CPU exhausted, service slows or stalls

When someone starts uploading a file to a website but stops partway, this Perl library can leave a leftover file on the server that is never cleaned up. Repeated attempts can fill up the server's temporary storage.

1. How it works:
2. Attacker
3. Parser starts file
4. Upload cut off
5. Orphaned file
6. Temporary storage is exhausted

A web app using this Perl module can be crashed by a single request that sends a huge number of form fields or file parts. The server runs out of memory or fills its disk with temporary files.

1. How it works:
2. Attacker
3. Body parser
4. Memory
5. Temp files
6. Server memory and disk exhausted

A user who is allowed to write to a Kafka topic can send one small, specially built message that makes the broker try to reserve a huge amount of memory. This can crash the broker or stop log cleanup until the bad message is removed.

1. How it works:
2. Authorized writer
3. Crafted batch
4. Broker decodes
5. Out of memory
6. Broker availability is denied

A logged-in Kafka user with no special permissions can trick the broker into reading files and environment settings on the server and showing their contents back. Those contents can include passwords and encryption keys.

1. How it works:
2. Authenticated user
3. Sends config request
4. Broker resolves variables
5. Reads file or env var
6. Attacker reads broker secrets

A single oversized-looking request can make a Kafka broker use up its memory and stop responding. This can happen before any login check, so the broker can be knocked offline by anyone who can reach it.

1. How it works:
2. Attacker sends request
3. Broker reads header
4. Field count declared
5. Objects allocated
6. Broker stops serving clients

A specially crafted request can make a Kafka broker run out of memory and crash. On listeners without a login requirement, anyone who can reach the broker can attempt this.

1. How it works:
2. Attacker sends request
3. Broker pre-allocates
4. Heap exhausted
5. Broker crashes
6. Broker goes down (denial of service)

Kafka brokers using OAuth-style logins can end up accepting login tokens without checking they are genuine. An attacker could then fake a token and gain full control of the cluster.

1. How it works:
2. Attacker forges token
3. Connects to listener
4. Broker skips verification
5. Impersonates superuser
6. Attacker gains full cluster control

A user who can only edit normal wiki pages can hide special commands in a page title or excerpt. When that page is included elsewhere, the commands run with the server's privileges, so the whole wiki can be taken over.

1. How it works:
2. Editor with basic rights
3. Malicious title or excerpt
4. excerpt-include runs
5. Code runs with macro rights
6. Attacker controls the XWiki installation

An administrator account on Wing FTP Server can create user folders that break out of their allowed area and write files anywhere on the system, which can lead to full control of the server. Because the install guide uses sudo, those files

1. How it works:
2. Admin account
3. Add user directory
4. Path escape
5. Write files
6. Attacker controls the server

Oracle's business software has a flaw that lets someone on the internet take control of part of it without logging in. Attackers have started scanning for systems that have not yet been updated.

1. How it works:
2. Attacker scans
3. Crafted HTTP request
4. SQL injection
5. Code execution
6. Attacker takes over the Oracle EBS component

A booby-trapped link could make the app run commands on your computer. This happens when you open the link, with the same rights as your user account.

1. How it works:
2. Attacker crafts link
3. User opens link
4. App processes URL
5. OS command runs
6. Attacker runs commands as the user

Attackers can exploit several bugs in the web browser to run their own code on your computer or steal and change data. Updating the browser closes these holes.

1. How it works:
2. Attacker
3. Browser flaw
4. Code runs
5. Data at risk
6. Attacker gains control of the browser session

A flaw in Adobe Campaign Classic lets someone with a basic user account run their own commands on the system. No clicks from a victim are needed, so it can be triggered without anyone noticing.

1. How it works:
2. Low-privilege account
3. Crafted input
4. Code injected
5. Code runs
6. Attacker runs arbitrary code on the system

Attackers can trick Oracle PeopleSoft into reaching its own hidden admin area, which can let them take control of the system. A criminal group called ShinyHunters has been using it since May.

1. How it works:
2. Attacker sends request
3. SSRF triggered
4. Loopback trusted
5. Internal interface reached
6. Attacker reaches internal management functions

Anyone who can reach the llama.cpp RPC server over the network can send oversized data that overwrites memory on the server. This can crash it, and in some cases could let an attacker run their own code.

1. How it works:
2. Attacker connects
3. Sends HELLO message
4. Sends oversized data
5. Stack overflows
6. Server crashes or attacker may run code

An administrator of the GRR room and resource booking app can plant malicious code in the LDAP login settings, which can then run on the server. The attack depends on the admin first connecting to an LDAP server that the attacker controls.

1. How it works:
2. Attacker-run LDAP server
3. Admin connects to LDAP
4. Malicious filter submitted
5. Config file poisoned
6. Attacker runs code on the GRR server

Node.js can be tricked into trusting a server's certificate for the wrong IP address when the address is typed with unusual full-width digits. An attacker in the network path could then impersonate that server.

1. How it works:
2. Attacker on network path
3. IP written with fullwidth digits
4. Node.js skips IP check
5. Wrong certificate accepted
6. Connection trusted for the wrong server

Node.js can read a hostname only up to a hidden 'end of text' marker, so a name that looks safe can be checked as one site but looked up as another. Apps that rely on that check could connect to the wrong server.

1. How it works:
2. Crafted hostname
3. Validation passes
4. dns.resolve truncates
5. Wrong records used
6. App trusts records for the wrong host

Someone who can talk to your MLflow server can register a model whose 'source' points at a folder on the server itself, then download files from that folder. This can expose secrets such as passwords stored on the server.

1. How it works:
2. Attacker sends request
3. Server stores path
4. Artifact endpoint runs
5. Server files read
6. Attacker reads files from the server

A flaw in MLflow lets someone send a crafted request that makes the server load and run their own Python code. If authentication is turned off, no password is needed.

1. How it works:
2. Attacker sends requests
3. Uploads Python module
4. Submits crafted scorer
5. Server imports module
6. Attacker runs code on the MLflow server

A program using the libXi input library can be crashed or possibly taken over if it connects to a malicious display server. The library trusts an oversized reply from that server and writes past the end of its memory buffer.

1. How it works:
2. Malicious X server
3. Client connects
4. Oversized reply
5. Heap overflow
6. Client memory corrupted, possible code execution

A small library many Linux desktop programs use to read mouse and keyboard input can be tricked into writing past the memory it reserved. A harmful display server could use this to crash programs or possibly run its own code.

1. How it works:
2. Malicious X server
3. Sends crafted data
4. libXi parses data
5. Heap overflow
6. Application crashes or may be compromised

A crafted web request can make the monitoring library inside a Node.js app use a lot of CPU while it inspects the URL. This can make the app slow or unresponsive for everyone.

1. How it works:
2. Attacker
3. Internet request
4. dd-trace regex
5. CPU exhausted
6. Application becomes slow or unavailable

Someone could save hidden code inside text written in the TinyMCE editor. When the media plugin processes it, that code can run in other users' browsers.

1. How it works:
2. Attacker submits content
3. Media plugin processes it
4. Script executes
5. Victim views the page
6. Attacker runs scripts in victims' browsers

A specially crafted piece of text pasted or loaded into the CKEditor rich-text box can make the browser run hidden code. That code can act as the logged-in user on the page.

1. How it works:
2. Attacker crafts content
3. Content enters editor
4. Engine processes styles
5. Script runs in browser
6. Attacker runs JavaScript in user browsers

A symbolic link (a shortcut to another file) inside a user's folder can point to a file elsewhere on the server. FileBrowser follows that shortcut and shows the file, even when the user should not be able to see it.

1. How it works:
2. Authenticated user
3. Symlink in scope
4. Symlink followed
5. Out-of-scope file read
6. Server files exposed to the user

A person who can open a pull request in a repository using Atlantis can hide system commands inside the workspace name. Atlantis then runs those commands on its server, with the server's access to cloud and repository credentials.

1. How it works:
2. Contributor opens PR
3. Atlantis reads config
4. Command built as string
5. Run via sh -c
6. Attacker runs commands as the Atlantis service account

A weakness lets someone upload a file of a dangerous type to the shop software, which can let them run their own code on the site and take over a logged-in user's account. The attacker typically needs a victim to visit a malicious link or a

1. How it works:
2. Attacker crafts link
3. Victim visits page
4. Malicious file processed
5. Code runs in user context
6. Attacker controls victim's account and session

Someone on the network could fake a login cookie by simply typing a username into it, and then act as that user. Because the flaw can lead to full control of the system, it is very serious.

1. How it works:
2. Attacker guesses username
3. Forged cookie sent
4. Login check accepts it
5. Diagnostic command runs
6. Attacker controls the device as root

A logged-in user on a Windows machine with Hyper-V could exploit a timing bug to get administrator-level control. Attackers usually need some existing access first.

1. How it works:
2. Local user
3. Race condition
4. Privilege escalation
5. Attacker gains elevated control of the host

If an app uses this HTTP library with a shared cache and follows redirects, a response from a different site can be saved under a trusted address. Later users may then receive that wrong or private content.

1. How it works:
2. Attacker controls redirect
3. Redirect followed
4. Cache key uses original URL
5. Later caller requests trusted URL
6. Attacker content served under trusted URL

If your app uses a custom rule to check which servers it trusts, that rule can be quietly ignored. A fake server with a certificate that passes normal checks could then be accepted by mistake.

1. How it works:
2. Impostor server
3. Network path
4. Agent connects
5. Trust check skipped
6. Impostor server is silently accepted

A server you connect to over HTTPS can make the Node.js program that calls it shut down completely. This happens when the server switches its encryption setup partway through a connection and presents a certificate that does not match the s

1. How it works:
2. Malicious server
3. TLS 1.2 renegotiation
4. Mismatched certificate
5. undici asserts
6. Client process terminates, dropping all work

A malicious or careless client can send huge requests or very long batches of messages to an MCP server exposed over HTTP. This can use up the server's memory and stop it from serving other users.

1. How it works:
2. Attacker sends requests
3. Request reaches server
4. No size limit applied
5. Memory exhausted
6. Server crashes or stops serving users