A specially crafted email address could make the software hosting site run commands it should not run. Researchers say this could let an attacker take over the site and change code that many people use.

1. How it works:
2. Registers malicious email
3. Address reaches backend
4. Commands execute
5. Escalates to superuser
6. Attacker could tamper with Bash source

Struts is a tool many websites use to build their pages. A flaw can let an attacker send a specially crafted request that makes the server run commands they choose.

1. How it works:
2. Attacker sends crafted request
3. Sandbox check passes
4. Reflection runs unchecked
5. Code runs on server
6. Attacker controls the server

Attackers on the internet may be able to send a specially crafted request to this WAVLINK router and make it run commands of their choosing. That could give them control over the device.

1. How it works:
2. Attacker sends request
3. DNS handler receives input
4. Command gets injected
5. Router is controlled
6. Attacker controls the router

Some users with limited accounts can perform actions that should be reserved for administrators. This can let them change things they should not be able to change.

A flaw in this WAVLINK router lets someone outside your network send a specially crafted input and make the device run commands they choose. That could give them full control of the router.

1. How it works:
2. Remote attacker
3. Router handler
4. Command executed
5. Attacker controls the router

Someone on your network, or anyone who can reach the router's web interface, could send a specially crafted request and take control of the router. A router takeover can expose all traffic passing through it.

1. How it works:
2. Attacker sends request
3. Request reaches router
4. Buffer overflows
5. Router code runs attacker input
6. Attacker may control the router

A flaw in this router's VPN settings lets someone on the internet send specially crafted input that overwrites part of the router's memory. Attackers could use that to disrupt or take over the device.

1. How it works:
2. Remote attacker
3. Request reaches router
4. OpenVPN Handler
5. Stack overflow
6. Router stack memory overflowed by crafted input

Attackers on the network can send a crafted request to this Wi-Fi router and make it run commands they choose. That can give them full control of the device.

1. How it works:
2. Attacker sends request
3. Request reaches router
4. Unsanitized group field
5. Command runs on router
6. Attacker controls the router

Attackers on the network could run commands on the router without logging in. That could let them take control of the device.

1. How it works:
2. Attacker sends request
3. Request reaches router
4. Handler passes input
5. OS command runs
6. Attacker runs commands on the router

Someone on the network could send a specially crafted group name to this router and make it run commands they choose. That could let them take control of the device.

1. How it works:
2. Attacker sends request
3. Request reaches router
4. Unsanitized input used
5. Commands run on device
6. Attacker runs commands on the router

Someone who can reach the router's web settings page may be able to send it specially crafted input and make it run commands of their choice. That could give them control of the device.

1. How it works:
2. Attacker sends crafted input
3. Request reaches the router
4. Router runs injected command
5. Attacker runs commands on the router

Attackers may be able to sneak database commands through the booking plugin's inputs, which could expose or change website data. Update the plugin to a fixed version as soon as one is available.

Someone on the network could send a specially crafted request to this router and make it run commands they choose. Public exploit code exists, so attacks are possible.

1. How it works:
2. Attacker sends request
3. Request reaches router
4. Input not sanitized
5. Injected command runs
6. Attacker can run commands on router

Attackers on the network can send a specially crafted setup request to this router and make it run commands they choose. That can let them take control of the device.

1. How it works:
2. Attacker sends request
3. Reaches router remotely
4. Input not sanitized
5. Commands execute on device
6. Attacker controls the router

Someone on the internet may be able to send a specially crafted file upload to this router and crash it or take control of it. A public exploit is reported to exist.

1. How it works:
2. Attacker sends crafted upload
3. TFTP upload handler
4. Stack buffer overflow
5. Router memory corrupted
6. Router may crash or be taken over

Anyone who knows a secret password hard-coded in the software can forge access passes and then run their own commands on the server without logging in. Attackers can take over the server.

1. How it works:
2. Attacker forges token
3. Forged share token
4. testTransform endpoint
5. Script runs via Groovy
6. Attacker controls the server

Jpom is a web tool for managing servers. A crafted request header can trick it into granting full admin rights to anyone, with no password needed. From there, attackers can run commands on the server.

1. How it works:
2. Unauthenticated attacker
3. Malicious token header
4. Condition parser runs
5. Super-admin granted
6. Attacker controls the Jpom server

Visitors to a page with a SimpleForm form can upload files that the website server may run as programs. That can let an outsider take control of the website.

1. How it works:
2. Attacker finds form
3. Nonce read from page
4. Trailing-dot file upload
5. Server stores executable file
6. Attacker may run code on the server

A flaw in this WordPress quiz and course plugin lets users with a basic account delete files on the website's server. Deleting a key settings file can let an attacker take over the whole site.

1. How it works:
2. Attacker sends request
3. Plugin route accepts path
4. Arbitrary file deleted
5. Site takeover possible
6. Attacker can run code on the server

Someone who knows a user's password can log in to that account even when the site has not approved it or has suspended it. No prior login is needed.

1. How it works:
2. Attacker has password
3. Crafted login request
4. Verification check skipped
5. Session cookie issued
6. Attacker logs into unverified or suspended account

A WordPress plugin for managing projects has a flaw that lets people with no login run commands on the website's server. That can let them take over the site and its data.

1. How it works:
2. Unauthenticated attacker
3. Crafted REST request
4. WordPress runs validation
5. PHP functions invoked
6. Attacker executes code on the server

A networking library can be tricked into running an attacker's code when it reads data from an untrusted source. The flaw is in how it unpacks certain incoming messages, and there is no planned fix for this version line.

1. How it works:
2. Attacker crafts payload
3. Payload sent to service
4. Decoder reads frame
5. Code runs on server
6. Attacker controls the server

Anyone on the internet can send a single web request that moves all your published popups to the trash, without logging in. Your popups stop showing to visitors until someone restores them.

1. How it works:
2. Attacker sends request
3. Missing authorization check
4. Preview parameter flaw
5. All popups trashed
6. All published popups moved to trash

A WordPress booking plugin lets any logged-in user, even a basic subscriber, delete booking calendar notes that belong to others. Someone could remove important notes without permission.

1. How it works:
2. Subscriber logs in
3. Calls remove-note action
4. No capability check
5. Calendar note deleted
6. Booking calendar notes are deleted by unauthorized users

A flaw in a WordPress invoice plugin lets someone with no login run harmful code on the store's server by placing a checkout order. Store owners using the affected versions need to act.

1. How it works:
2. Attacker places order
3. Request sent to store
4. Note reaches invoice code
5. Malicious data deserialized
6. Attacker executes code on the server

A flaw in the LeadSnap plugin lets an outside visitor send specially crafted data that makes the website run commands it should not run. Anyone who can reach the site can try it, with no password needed.

1. How it works:
2. Attacker
3. Public site
4. Object injection
5. Code execution
6. Attacker controls the website server

Anyone on the internet can send specially crafted data to this WordPress plugin and potentially run code on the site without logging in. Site owners using the affected version should update right away.

Anyone on the internet can send specially crafted input to the Transliterator component and make the website's database run commands the site owner never intended. This could expose or change stored data without logging in.

1. How it works:
2. Anonymous attacker
3. Crafted request
4. Transliterator flaw
5. SQL executed
6. Attacker reads or alters database data

A flaw lets an attacker send specially crafted data to the Royal Event theme that the website then trusts and processes. This can let the attacker take control of the website.

A flaw in the Widget Options plugin could let an outside attacker run their own commands on the website's server. That can mean taking over the site or stealing its data.

Anyone on the internet can, without logging in, gain higher access rights on affected WordPress sites. This could let an attacker take over parts or all of the site.

Visual Studio does not properly check whether a server's security certificate is genuine. An attacker on the same network could pretend to be a trusted server.

Programs that show translated text can be tricked into loading a translation file from a folder chosen by an attacker. A crafted file can crash the program or run attacker code with the program's permissions.

1. How it works:
2. Attacker sets env
3. Program runs
4. Loads .mo file
5. Malicious catalog
6. Program crashes or attacker runs code

Anyone with a Flowise login can slip code past the tool's safety limits and make the server run commands of their choosing. That can give them control of the machine running Flowise.

1. How it works:
2. Logged-in user
3. Custom function endpoint
4. Mammoth file write
5. vm2 sandbox escape
6. Attacker runs commands on the server

If an app uses pybars4 to render Handlebars templates and lets outsiders supply or influence those templates, an attacker can make the app run their own Python code on the server. The attacker could then read or change data and take over th

1. How it works:
2. Attacker crafts template
3. App renders template
4. Code breaks out
5. Python code runs
6. Attacker executes code on the server

If an app uses pybars3 to render templates that come from users or other untrusted sources, someone could hide Python commands in the template and make the server run them. That can mean full control of the server.

1. How it works:
2. Crafted template
3. App renders template
4. Injection triggers
5. Python executes
6. Attacker runs code on the server

Anyone who can reach the LMDeploy server over the network can send it specially crafted data and make it run commands on the machine. No login is needed to do this.

1. How it works:
2. Remote attacker
3. Reaches API
4. Pickle loaded
5. Command runs
6. Attacker controls the server

vLLM is software for running AI language models on a server. Several weaknesses could let an attacker read information they should not see, change data, bypass security checks, or make the service stop working.

A weakness in Ruby on Rails, a popular framework for building websites, lets an anonymous outsider pull data they should not see. That data could help them take over more of the system.

OpenDeepWiki uses a secret key to sign login tokens, and that key is written in a public config file. Anyone who reads it can create a fake admin login and take control of the whole system without a password.

1. How it works:
2. Attacker reads config
3. Forges admin token
4. Sends token to server
5. Server accepts token
6. Attacker controls the admin functions

Attackers could find several weak spots in Red Hat's automation software. Depending on the flaw, they could gain more control than they should, read or change data, or knock the system offline.

Someone on the same network address as a user of this FTP server could potentially take over that user's file transfers, stealing downloaded files or injecting data into uploads. No password is needed for the attacker.

1. How it works:
2. Attacker on same IP
3. Obtains TLS ticket
4. Connects to PASV port
5. Steals or injects data
6. Victim's file transfers are hijacked

Attackers who can control a database sort-order (collation) setting in CakePHP can slip extra database commands into a query. That can let them read, change or delete data.

1. How it works:
2. Attacker
3. CakePHP code
4. Database query
5. Attacker runs SQL with app database rights

Attackers can slip database commands into a web app built with CakePHP through certain input fields, letting them read or change data. Apps that pass user input into database window functions are at risk.

1. How it works:
2. Attacker sends input
3. App forwards value
4. Query executes
5. Data exposed
6. Attacker runs SQL on the database

A bug in the ClickHouse database server could let someone on the network run their own commands on the machine without logging in. Under certain conditions, an attacker could take control of the server.

Someone on the internet could send a specially crafted request to this management software and make it run commands of their choosing. That would let them take control of the system without logging in.

1. How it works:
2. Attacker
3. Network access
4. Vulnerable service
5. Command execution
6. Attacker controls the server

Attackers on the internet may be able to get around protections, read data they should not see, change data, or overload the Tomcat web server so it stops working. The exact fixed versions are not named in the material.

Attackers may be able to get malicious code to run in the Edge browser just by getting you to visit something they control. Once that happens they could take more control of your computer or access data.

1. How it works:
2. Attacker
3. Lure
4. Edge flaw
5. Code runs
6. Attacker gains code execution on the device

Attackers on the internet may be able to tamper with data or crash services on affected Red Hat Linux systems. Some of the flaws could also let them bypass security checks or read private information.

Bouncy Castle is a Java library that programs use for encryption. Attackers can exploit several flaws in it to bypass security checks, read or change data, or crash the software.

Attackers who can reach the device over the network can skip the login check and make it run commands on the device itself. That can let them take over the router or switch.

1. How it works:
2. Attacker
3. Device API
4. Validation skipped
5. Command run
6. Attacker controls the router or switch

Attackers who can reach a website's form can slip in specially crafted data that the site then trusts and processes as code-like objects. On some sites this can lead to an attacker taking control of the server.

1. How it works:
2. Unauthenticated attacker
3. Gravity Forms processes input
4. Object stored in post meta
5. Gadget chain triggered
6. Attacker may gain remote code execution

Some ways of listing records in Apache Fineract let an outside user slip database commands into the sort settings. That can let them read or change data they should not see.

Attackers can send specially crafted input to a search feature and make the system run database commands they wrote. That can expose or change the financial records stored in the database.

1. How it works:
2. Attacker sends input
3. Request reaches API
4. Input not sanitized
5. Database runs attacker SQL
6. Attacker reads or alters database records

Someone on the network with no login could run their own commands on the affected server. That would give them full control of a machine that manages backup and virtualization monitoring.

1. How it works:
2. Attacker on network
3. Reaches service
4. Flaw triggered
5. Code executes
6. Attacker controls the affected server

Langflow is a tool for building AI workflows. A flaw lets someone outside your network skip the login checks and get access they should not have.

Attackers who do not have an account can send specially crafted data to Zoho Flow and make it run commands it should never run. This can let them take control of the system that runs it.

1. How it works:
2. Attacker sends request
3. App unserializes input
4. Malicious object triggers code
5. Server compromised
6. Attacker controls the server

Attackers who need no login can send specially crafted data to this software and make it run commands on the server. This could let them take over the website or its data.

1. How it works:
2. Attacker
3. Crafted request
4. Gunslinger
5. Code runs
6. Attacker may control the server

Someone on the internet can send a specially crafted request to a website using this plugin and make it do things it should not, without needing an account. This can let attackers take over the site.

1. How it works:
2. Attacker
3. Crafted request
4. Plugin unserializes input
5. Code runs on server
6. Attacker controls the website server

Someone on the internet with no login can send specially crafted data to the Gamic website software and potentially make it run code the attacker chose. This can let them take over the site.

1. How it works:
2. Attacker sends crafted data
3. Gamic unsafely unserializes input
4. Malicious object triggers code
5. Attacker gains control
6. Attacker controls the server

Attackers can send specially crafted data to the Gamezone website and make it run commands they choose, without needing a password. Anyone running this software is at risk of having their site and server taken over.

1. How it works:
2. Attacker
3. Crafted request
4. Unsafe input handling
5. Code execution
6. Attacker controls the server

A flaw in this software lets an outside attacker, with no password, send specially crafted data that makes the website run commands it should not run. In practice, the attacker could take control of the site.

1. How it works:
2. Attacker
3. Crafted request
4. Plugin unserializes data
5. Code runs on server
6. Attacker may control the website server

Attackers can send specially crafted data to the website and make it run commands they choose, without needing an account. If you use this plugin, your site could be taken over.

1. How it works:
2. Attacker sends crafted data
3. Plugin unserializes input
4. Malicious object runs
5. Server is compromised
6. Attacker controls the website server

Someone on the internet can send specially crafted data to the Coinpress website and make it run code they choose, without needing a login. Anyone running an affected version should update or take it offline until fixed.

1. How it works:
2. Attacker sends crafted data
3. Coinpress reads the data
4. Malicious PHP object runs
5. Data or server exposed
6. Attacker may control the server

Attackers who need no login can send specially crafted data to the Bonbon WordPress plugin, which may let them run harmful code on the website. Anyone running an affected version should act quickly.

1. How it works:
2. Attacker
3. Crafted request
4. Bonbon plugin
5. PHP object created
6. Attacker may run code on the server

Anyone on the internet can send specially crafted data to the Avventure plugin, which can make the website run commands on its server without logging in. This could let an attacker take over the site.

1. How it works:
2. Attacker
3. Public request
4. Avventure plugin
5. Server
6. Attacker can run code on the server

Attackers who need no login could send specially crafted data to a website using this plugin, which can make the site run harmful code. This can let them take control of the site or steal its data.

1. How it works:
2. Attacker sends crafted request
3. Plugin unserializes input
4. Malicious object triggers code
5. Attacker may control the server

Attackers can send specially crafted data to the Orpheus software without logging in, which may let them run their own code on the server. Anyone running an affected version should treat it as urgent.

1. How it works:
2. Attacker sends payload
3. Orpheus unserializes input
4. Code runs on server
5. Attacker may gain control of the server

Attackers who need no login can send specially crafted data to the Nuts software, which can make it run hidden code on the server. This could let them take over the site or read its data.

1. How it works:
2. Attacker sends payload
3. Nuts unserializes input
4. Code runs on server
5. Attacker may control the server

Attackers can send specially crafted data to the Muzicon theme and make the website run commands they choose, without needing a password. Anyone running this theme's older versions should act right away.

1. How it works:
2. Attacker
3. Public request
4. Unsafe deserialization
5. Code execution
6. Attacker controls the web server

A flaw in the Motorix plugin for WordPress lets anyone on the internet send specially crafted data to the site, which can make the server run harmful code. No login is needed to attempt it.

1. How it works:
2. Attacker sends request
3. Plugin reads input
4. Malicious object created
5. Code runs on server
6. Attacker controls the website server

A flaw in the Mission plugin could let anyone, without logging in, send specially crafted data that makes the website run harmful code. Attackers could then take over the site or steal its data.

1. How it works:
2. Attacker sends crafted request
3. Plugin unserializes input
4. Malicious code runs
5. Site compromised
6. Attacker takes control of the website

A flaw in this WordPress plugin lets anyone on the internet send specially crafted data that can make the website run hidden commands. No login is needed to trigger it.

Attackers without any login can send specially crafted data to the Marcell site and potentially take control of it. Anyone running an affected version should update or restrict access quickly.

1. How it works:
2. Attacker
3. Crafted request
4. Marcell app
5. Server
6. Attacker may control the server

Attackers who do not need an account could send specially crafted data to the website and make it run hidden code on the server. This can let them take control of the site or its data.

1. How it works:
2. Attacker
3. Crafted request
4. Le Truffe plugin
5. Server
6. Attacker may control the server

Attackers without a login can send specially crafted data to the site, which may let them run code or take control of the website. Anyone running the affected plugin should update or remove it right away.

1. How it works:
2. Attacker
3. Crafted request
4. Plugin unserializes input
5. Code runs on server
6. Attacker may take control of the site

A flaw in this WordPress plugin lets people with no login send specially crafted data that the site then trusts, which can lead to a full takeover of the website. Anyone running the affected version should act right away.

1. How it works:
2. Attacker sends crafted data
3. Plugin unserializes input
4. Malicious object runs
5. Attacker may control the website server

A flaw in this WordPress plugin lets anyone on the internet send a request that makes the website run commands they choose, without needing a password. An attacker could take over the site.

Attackers who have never logged in can send specially crafted data that makes the website's software run commands they choose. This can let them take over the site and the data it holds.

1. How it works:
2. Attacker
3. Crafted request
4. Ozisti app
5. Server
6. Attacker controls the server

Attackers who do not need a password could send specially crafted data to a website using this plugin, which can make the site run harmful code. This can let them take control of or damage the site.

1. How it works:
2. Attacker sends payload
3. Plugin unserializes input
4. Malicious object triggers code
5. Server compromised
6. Attacker controls the website server

Printy is software that handles data sent to it. A flaw lets anyone on the internet send specially crafted data that makes the software run commands it should not, without needing a login.

1. How it works:
2. Attacker
3. Internet
4. Printy app
5. Server
6. Attacker may gain control of the server

A WordPress-style add-on called Quirky has a flaw that lets anyone on the internet send specially crafted data to the site and make it run commands, without needing a password. Attackers could take over the site or steal its data.

1. How it works:
2. Attacker sends payload
3. Quirky unpacks data
4. Malicious object runs
5. Attacker gains control of the server

Attackers without any login may be able to send specially crafted data to the RexCoin plugin and make the website run their code. This can let them take over the site.

A flaw in this login-security server can let someone reach features they should not be allowed to use. The material does not describe exploitation or a fix in detail.

Langflow is a tool for building AI workflows. A flaw lets an outside attacker send specially crafted input that makes the server run commands of the attacker's choosing.

A flaw in IBM Langflow, a tool for building AI workflows, lets someone who has a login run their own commands on the server. That can mean taking control of the machine.

Langflow is a tool for building AI workflows. A flaw lets someone with a login to the software run their own commands on the server it runs on, which could take over the machine.

1. How it works:
2. Attacker logs in
3. Malicious input sent
4. Code passed to eval/exec
5. Commands run on server
6. Attacker controls the server

Langflow is a tool for building AI workflows. A flaw lets someone with a normal login run their own commands on the server running it, because the software fails to check whether they are allowed to do that.

1. How it works:
2. Attacker logs in
3. Missing authorization
4. Code execution
5. Attacker controls the server

Langflow is a tool for building AI apps. A flaw lets an outside attacker send crafted input that makes the server run commands of the attacker's choosing, which could mean full control of the machine.

1. How it works:
2. Attacker sends input
3. Input reaches OS command
4. Command runs on host
5. Attacker runs arbitrary code on the server

Agno is a framework for building AI agents. A flaw lets someone hide instructions in text the AI reads, tricking the agent into running dangerous data-loading functions that can execute code on the server or read files from it.

1. How it works:
2. Attacker plants prompt
3. Agent calls PandasTools
4. getattr invokes pandas
5. read_pickle or readers run
6. Attacker runs code or reads local files

A rogue VNC server you connect to can send data that tricks your TightVNC viewer into writing memory it should not touch. This can crash the viewer or possibly let an attacker run their own code on your computer.

1. How it works:
2. Rogue VNC server
3. Crafted screen size
4. Integer overflow
5. Out-of-bounds write
6. Viewer memory corrupted, possible code execution

Grafana is a dashboard tool for charts and monitoring. Several bugs let someone who already has a login do more than they should, such as reading data or disrupting the service.

Sophos UTM is a security appliance that sits between your network and the internet. A flaw lets an anonymous outsider take full control of it without logging in.

1. How it works:
2. Remote attacker
3. Sends crafted request
4. Flaw triggered
5. Admin rights gained
6. Attacker controls the Sophos UTM appliance

Several weaknesses in add-on modules for the Drupal website software let attackers take control of user accounts, gain higher access rights, or read and change data. Websites using these add-ons could be compromised.

WebKitGTK is the web engine used by some Linux apps to show web pages. Attackers can exploit several bugs in it to crash the app, read information they should not see, or bypass security protections.

Attackers can send a specially crafted request to this Yamaha wireless router and make it run commands they choose. That could let them take control of the device.

1. How it works:
2. Attacker sends request
3. Router processes input
4. OS command runs
5. Attacker controls the router

Attackers could crash these systems, bypass security checks, or in some cases run their own code or read and change data. Apache Camel's flaw could let an anonymous remote attacker get around protections.

Attackers can slip hidden commands into the website's database requests, which can let them read or tamper with stored data. The site owner may not notice it happening.

1. How it works:
2. Attacker sends crafted request
3. Plugin builds SQL query
4. Database runs injected SQL
5. Data is leaked
6. Attacker reads site database data

Attackers could crash these virtualization products, read data they should not see, get around security checks, or run their own code. Anyone running VMware virtual machines or management servers should update quickly.

Attackers on the internet can type special text into the password recovery form and trick the system's database into revealing or changing its data. No login is needed to try this.

1. How it works:
2. Unauthenticated attacker
3. Password recovery form
4. Insufficient input validation
5. Database executes query
6. Attacker reads or modifies platform data

Attackers who already have a login to your Google Cloud Kubernetes (GKE) setup could run their own commands, bypass protections, or crash services. Patch the cluster to close these gaps.

An attacker on the network can pretend to be any user when calling certain remote business components of the WildFly application server, without logging in. This can let them read or change data they should not reach.

1. How it works:
2. Remote attacker
3. IIOP port 3528
4. CSIv2 interceptor
5. @Remote EJB
6. Attacker acts as any user

Someone on the internet with no password could upload a file to the NUUO video management server and make it run commands on the machine. That could let them take control of the server and the camera system it manages.

1. How it works:
2. Remote attacker
3. Crystal upload.php
4. PHP web root write
5. lighttpd fastcgi runs PHP
6. Attacker controls the NUUO server

FUXA is a web tool for monitoring industrial equipment. A flaw lets someone without a login send a crafted web request that makes the server run commands of their choosing.

1. How it works:
2. Attacker
3. Crafted HTTP request
4. Auth bypass
5. Code execution
6. Attacker controls the FUXA server

A flaw in this WordPress plugin lets an outsider take over any user account, including site administrators, just by knowing the username. The attacker can then fully control the website.

1. How it works:
2. Attacker sends forged update
3. Plugin trusts input
4. Username maps to account
5. Login token issued
6. Attacker logs in as any user

A logged-in administrator of this industrial cellular router can hide system commands inside ordinary settings fields, and the router then runs them. Anyone who gets admin access can take over the device.

1. How it works:
2. Admin account
3. Saved settings
4. Router runs input
5. Command executes
6. Attacker controls the router

A messaging library could let an unauthenticated sender slip past the login step. Whether this matters depends on how each application handles connections that have not finished logging in.

1. How it works:
2. Attacker connects
3. Frame labeled SASL
4. Library dispatches it
5. Login step skipped
6. Unauthenticated access may be possible

A logged-in user of a shared AI gateway can make it use another customer's private API keys. The attacker can then run AI requests on that customer's account, using their paid quota and billing.

1. How it works:
2. Authenticated attacker
3. Crafted request
4. Gateway processes request
5. Shared credential store
6. Victim's LLM quota consumed by attacker

A person who already has administrator access to VMware ESX servers can do things that leave no record in the logs. That makes it harder to notice or investigate an intrusion.

1. How it works:
2. Admin access gained
3. Hidden operations
4. Audit trail gaps
5. Intrusion goes undetected in logs

A typo-like change in a header name can make the server read one request differently than a proxy in front of it does. Attackers can use that gap to sneak hidden requests through to the server.

1. How it works:
2. Attacker crafts request
3. Vert.x misreads header
4. Proxy and server disagree
5. Smuggled request processed
6. Attacker bypasses controls or hijacks requests

Someone on the network can send specially crafted web requests to a router that has not yet been set up in Juniper's cloud management, and gain full administrator control without logging in. Once the router is connected to Mist/Conductor, t

1. How it works:
2. Attacker on network
3. Insecure endpoint
4. Root execution
5. Admin privileges
6. Attacker controls the router as admin

Attackers who can send a specially crafted device name to this network controller can make it run their own commands with full administrator rights. That could let them take over the whole system.

1. How it works:
2. Remote attacker
3. Provisioner input
4. Unsanitized command
5. Root shell
6. Attacker controls the Conductor as root

A flaw lets attackers send specially crafted data to the Ultimate Member plugin, which can make the website run attacker-chosen code or actions. Sites that use this plugin could be taken over or have their data stolen.

Attackers may be able to send crafted input to HCL BigFix AEX and make it run commands they choose, which could let them read data or take over the system. The advisory does not say how this is triggered.

A weakness in this WordPress-related toolkit lets an attacker sneak database commands through a website input. That can let them read or change data the site stores.

1. How it works:
2. Attacker
3. Toolkit code
4. Database
5. Data exposed
6. Attacker reads or alters site data

A flaw in this WordPress marketing plugin lets an outsider sneak database commands through its inputs. That can let them quietly read the site's stored data, such as customer or account information.

1. How it works:
2. Attacker
3. Plugin input
4. Database query
5. Data leak
6. Attacker extracts site database data

Attackers could exploit several security holes in GitLab to run their own commands on the server, read information they should not see, or change data. Patching is the way to close these gaps.

A helper service in Eclipse Che can be tricked into running commands an attacker types into web requests. If its login protection is turned off, anyone who can reach it over the network can take control of the containers it manages.

1. How it works:
2. Attacker sends request
3. Reaches exec endpoint
4. Unescaped shell command
5. Command substitution runs
6. Attacker controls the container

Someone on the same network could call hidden functions in the app without logging in. They could steal database passwords, run commands on the database, and potentially take over the server it runs on.

1. How it works:
2. Attacker on network
3. Calls RMI methods
4. Obtains credentials
5. Runs SQL on PostgreSQL
6. Attacker controls the server

A user with a basic account and remote network access may be able to perform actions they should not be allowed to, such as operating systems this center manages. Attackers could use this to take control of backup storage that the product o

1. How it works:
2. Low-privilege user
3. Management center
4. Managed systems
5. Unauthorized operations run on managed systems

A flaw in Dell's backup management software lets someone with a basic low-privilege account send special commands to its database. That can give them access to the systems the software manages.

1. How it works:
2. Low-privilege attacker
3. Crafted input
4. Database executes it
5. Managed systems exposed
6. Attacker gains unauthorized access to managed systems

An attacker on the network could send specially crafted data to the backup appliance and take control of it, without needing a password. Backup systems are a prime target because they hold copies of important data.

1. How it works:
2. Remote attacker
3. Crafted network input
4. Buffer overflow
5. Command execution
6. Attacker controls the backup appliance

Dell's backup storage appliances contain a built-in secret key that is the same on every copy. An attacker on the network can use it to reveal stored login details and then sign in as a legitimate user.

1. How it works:
2. Remote attacker
3. Reaches appliance
4. Uses hard-coded key
5. Credentials exposed
6. Attacker logs in as the compromised user

Attackers can send specially crafted web requests to the product's private area and read the database behind it, including customers' personal details. No login is needed to try this.

1. How it works:
2. Attacker sends request
3. WAF is bypassed
4. Unvalidated query runs
5. Database is queried
6. Attacker reads customer personal data

A flaw lets someone with a basic low-level account reach features they should not control, by pretending to be a trusted party. Because this system manages other backup systems, the damage could spread beyond it.

1. How it works:
2. Low-privilege attacker
3. Spoofed identity
4. Management center
5. Managed systems
6. Attacker gains elevated control of backup management

Someone on the network could get into this backup storage system without a password and gain full control of it. Dell says to update as soon as possible.

1. How it works:
2. Remote attacker
3. Reaches system
4. Auth bypassed
5. Commands run
6. Attacker gains full control of the appliance

Attackers on the network could log in without a password and create new privileged accounts, giving them full control of the backup storage system. Updating the software closes this hole.

1. How it works:
2. Remote attacker
3. Reaches device
4. Auth bypass
5. Admin account created
6. Attacker gains full control of the system

Anyone on the internet can upload a file to the website without logging in. Under specific server settings, that file could be run as a program, letting an attacker take over the server.

1. How it works:
2. Anonymous attacker
3. Crafted upload request
4. Extension check bypassed
5. File saved then removed
6. Attacker may run code on the server

Someone who already has a login to the system could trick the multi-factor login service into running their own commands on the server. That could give them control of the machine.

1. How it works:
2. Logged-in attacker
3. Malicious MFA input
4. Code injected
5. Commands execute
6. Attacker controls the server

Anyone on the internet, even without logging in, can upload files such as PHP scripts to the website. If the server runs those files, an attacker can take control of the site.

1. How it works:
2. Attacker
3. Upload request
4. Plugin accepts file
5. File saved to server
6. Attacker runs code on the server

Attackers who have no password can log in to a WordPress site as its administrator through the plugin's X (Twitter) login feature. That can give them full control of the website.

1. How it works:
2. Attacker visits login
3. Plugin uses owner token
4. X returns owner profile
5. Login matched by email
6. Attacker is logged in as administrator

A widely used Java library that reads JSON data can be fooled into creating objects of classes it should refuse. An attacker who can send crafted data to the application may be able to run commands on the server.

1. How it works:
2. Attacker sends JSON
3. Jackson accepts type
4. Gadget class created
5. XML loaded
6. Attacker runs commands on the server

A bug in the Edge browser could let an outside attacker run their own code on your computer without you doing anything special. The browser mixes up the type of data it is handling, which an attacker can abuse.

1. How it works:
2. Attacker
3. Edge browser
4. Code runs
5. Your computer
6. Attacker runs code on the computer

A flaw in Microsoft Edge lets an attacker get past one of the browser's built-in safety checks over the network. Because the check fails to block certain inputs, the browser may trust content it should have rejected.

1. How it works:
2. Attacker
3. Network
4. Edge browser
5. Security bypass
6. Browser security feature is bypassed

A specially crafted web link or page could trick Adobe Connect into running an attacker's code. The attack needs a logged-in user to click or visit it.

1. How it works:
2. Attacker crafts link
3. User visits link
4. Code injected
5. Code runs as user
6. Attacker runs code as the victim

Someone on the network without a login could get past access checks on the CDP Coordinator Service and do things they should not be allowed to do. Treat this as urgent.

Attackers may be able to pose as real servers that HCL Notes Client connects to, and read or change the data sent between them. This is possible because some certificate authority private keys used to vouch for those servers were stolen.

1. How it works:
2. Attacker obtains CA keys
3. Attacker positioned on network
4. Fake certificate created
5. Notes Client trusts it
6. Outbound Notes traffic is intercepted or altered

Attackers may be able to pretend to be trusted websites and read or change data sent by the server over supposedly secure connections. This happens because the private keys of some certificate authorities used to vouch for those sites were

1. How it works:
2. Attacker obtains CA keys
3. Attacker positioned on network
4. Server accepts spoofed certificate
5. Traffic read or modified
6. Encrypted server traffic intercepted by attacker

A flaw in Veeam's Microsoft 365 backup software can let a connected organization sneak database commands into the server and take control of it. This can expose or change configuration data for other customers.

1. How it works:
2. Malicious peer
3. Crafted transfer request
4. Config database
5. Code execution
6. Attacker controls the backup server

A flaw in Adobe Campaign Classic lets an attacker send specially crafted input that the software runs as database commands. This can let them take over the account or session that the software is running under, without anyone clicking anyth

1. How it works:
2. Attacker sends input
3. ACC builds SQL
4. Database runs commands
5. Code runs as user
6. Attacker gains control of the session

A weakness in Adobe Campaign Classic lets someone with a basic user account take control of the software and run their own code. No action from a real user is needed for this to happen.

1. How it works:
2. Low-privileged account
3. Authorization flaw
4. Code execution
5. Attacker runs code on the system

A flaw in Adobe Campaign Classic lets someone with a basic account reach data they should not see, and change some of it. No user clicks are needed for an attack.

1. How it works:
2. Low-privilege attacker
3. Crafted input
4. Database query
5. Unauthorized access
6. Attacker reads and alters data without permission

A flaw in Adobe Campaign Classic lets a user with low-level access send specially crafted database commands and run their own code on the system. No user action is needed to trigger it.

1. How it works:
2. Low-privileged user
3. Crafted input
4. SQL injection
5. Code execution
6. Attacker runs arbitrary code on the server

A flaw in Adobe Campaign Classic lets a user with high privileges sneak database commands into the system, which can let them run their own code on the server. No extra clicks from other users are needed.

1. How it works:
2. Privileged attacker
3. Crafted input
4. SQL executed
5. Code execution
6. Attacker runs code on the server

A weakness in Adobe Campaign Classic lets someone with a basic user account run their own commands on the computer hosting it. No one else has to click anything for this to happen.

1. How it works:
2. Low-privileged attacker
3. Crafted input
4. OS command runs
5. Arbitrary code runs
6. Attacker runs code on the server

A malicious link could trick a logged-in user into running hidden code in Adobe Campaign Classic, which could let an attacker take over that user's session. The attack needs the victim to click a crafted link or visit a compromised page.

1. How it works:
2. Attacker crafts URL
3. Victim receives link
4. Victim clicks link
5. Script reflected in page
6. Attacker gains control of user session

A flaw in the WebSocket handling of WatchGuard firewall software lets someone outside the network send a specially crafted request that corrupts the device's memory. No login is needed, and this can let an attacker take control of the firew

1. How it works:
2. Remote attacker
3. Crafted request
4. Integer overflow
5. Heap write
6. Firewall memory corrupted, possible takeover

Attackers on the network can send a specially crafted request to a firewall's cluster management address and make it perform administrative tasks, without logging in. This can give an attacker control over the firewall.

1. How it works:
2. Remote attacker
3. Crafted request
4. FireCluster daemon
5. Admin action runs
6. Attacker controls the firewall

A flaw in the firewall's phone-call (SIP) handling lets an outsider send a specially crafted message that can run their own code on the device, without logging in. Anyone relying on that firewall should update it right away.

1. How it works:
2. Remote attacker
3. Crafted SIP request
4. Firewall SIP proxy
5. Code execution
6. Attacker controls the firewall

Someone who can reach the link between firewalls in a cluster can send a crafted message and make the firewall do privileged administrative actions, with the highest system rights. No password is needed to do this.

1. How it works:
2. Attacker on link
3. Cluster interconnect
4. FireCluster Sync
5. Firewall as root
6. Attacker controls the firewall as root

Attackers can trick a logged-in site administrator into clicking a hidden link or visiting a booby-trapped page, which then makes changes on the website without the admin knowing. The attacker could potentially take control of the newslette

1. How it works:
2. Attacker builds page
3. Admin visits page
4. Browser sends request
5. Plugin accepts request
6. Plugin actions run as the admin

A flaw in the firewall's login checking can let an attacker who controls or intercepts traffic to the company's Active Directory server crash the firewall or possibly run their own code on it. Attackers would need to sit in the network path

1. How it works:
2. Attacker positioned
3. Crafted AD reply
4. Auth service parses reply
5. Firewall impacted
6. Firewall crashes or attacker gains control

Attackers who can sit in the network path to the company's directory server (Active Directory) can send a specially crafted reply that breaks the firewall's login service. This can take the firewall offline or possibly let an attacker run t

1. How it works:
2. Attacker in network path
3. Forged AD response
4. Auth service overflow
5. Firewall impact
6. Firewall crashes or attacker gains control

Attackers who can intercept and decrypt the connection between a WatchGuard firewall and WatchGuard Cloud could send a fake settings file. This could crash the firewall or possibly let the attacker run their own code on it.

1. How it works:
2. Attacker in the middle
3. Intercept TLS traffic
4. Tampered config payload
5. Firebox overflows buffer
6. Firewall crashed or attacker controls it

A user with normal permission to edit company records can sneak database commands into the form and read hidden data, including admin password hashes. Attackers with a regular account could take over the system.

1. How it works:
2. Logged-in user
3. Tampered POST
4. Unescaped query
5. Data exposed
6. Attacker reads the entire database

A flaw lets someone reach parts of the NeMo Agent Toolkit without proving who they are. An attacker could then run code, gain higher access, change data, or take the service offline.

1. How it works:
2. Attacker sends request
3. Toolkit accepts request
4. Privileged action runs
5. Attacker gains control of the service

Several bugs in the Go programming language can be abused by attackers. Some could crash a program or show users false information.

Squid is a widely used proxy server that sits between users and the internet. A flaw in it could let an outside attacker get around its protections and see information they should not have.

Podman, a tool for running containers, has security flaws that let an outside attacker change files or see information they should not. Some of these need the attacker to have a login.

Attackers may be able to crash the Apache web server, read data it should keep private, change files, or in some cases run their own code on it. The second advisory lists higher-privilege access and arbitrary code execution as possible outc

Several weaknesses in the Apache web server could let an outside attacker run their own commands on the server, crash it, get past security checks, or read private data. Attackers do not need a login to try.

1. How it works:
2. Remote attacker
3. Crafted request
4. Apache flaw triggered
5. Code runs or crash
6. Attacker controls or disrupts the web server

Squid is a widely used web proxy server. Attackers on the internet can exploit several bugs in it to crash or overload the server, so people using it can no longer get web access through it.

1. How it works:
2. Remote attacker
3. Internet traffic
4. Squid proxy
5. Service stops
6. Proxy service becomes unavailable

Squid is a widely used internet proxy server. Attackers on the network can exploit these flaws to make it stop working or to see information it should keep private.

vLLM is software for running AI language models on servers. Several security holes could let an attacker run their own code on the server, crash it, see data it should not, or bypass safety checks.

Several software components on Red Hat Enterprise Linux have security holes. Attackers could bypass protections, crash services, or in some cases run their own code.

A user with a limited management role on Octopus Server (a tool that deploys software) can take control of the whole system and act as an administrator. Anyone with that role could do far more than they should.

1. How it works:
2. Low-privilege user
3. Octopus Server
4. Admin rights gained
5. Full system control
6. Attacker controls the Octopus Server

When someone invites a new user to Octopus Server, the invite code is saved in the audit log. A user who can read that log could copy the code and use it to get more access than they should have.

1. How it works:
2. Invitation created
3. Code written to audit log
4. Space member reads log
5. Invitation redeemed
6. Attacker gains the invited user's privileges

A flaw in how Octopus Server checks login tokens could let someone from an untrusted login provider sign in as a trusted automation account. The attacker would need to know some details of that account's login setup.

1. How it works:
2. Attacker sets up issuer
3. Forged token issued
4. Inconsistent validation
5. Login accepted
6. Attacker acts as the service account

A flaw in the HiRDB database server means someone who can reach it over the network may be able to use sensitive functions without logging in. Anyone with access to the database could read, change, or disrupt data.

Attackers without any password can log into your WordPress site as an administrator, if they know or can guess an admin username. From there they can take over the whole site.

1. How it works:
2. Attacker visits site
3. Harvests nonce
4. Sends forged login request
5. Plugin skips token check
6. Attacker controls the admin account

A server's management controller can be tricked into running commands from an attacker over its remote-management network protocol. An attacker who gets this access could take control of the machine.

A flaw in Fortinet firewall software lets someone without a login send specially crafted web requests that can make the device's HTTPS admin page stop responding. The firewall itself is not stated to be taken over.

1. How it works:
2. Remote attacker
3. Crafted HTTP requests
4. Locking flaw triggered
5. Admin interface stalls
6. Admin web interface denied to legitimate users

A flaw in this TOTOLINK router's web management page lets someone on the network send a specially crafted request that overflows memory. This can let an attacker crash the router or possibly run their own commands on it.

1. How it works:
2. Attacker
3. Web admin page
4. Buffer overflow
5. Router
6. Attacker may control the router

Someone on the internet with no login could trick the toolbox into copying files off your server into an outside cloud storage bucket, or overwriting files on your server. Anyone running it could have their files stolen or changed.

1. How it works:
2. Unauthenticated attacker
3. Crafted tool request
4. Toolbox cloud-storage source
5. Host files read or overwritten
6. Attacker steals or overwrites server files

A background service runs with full administrator power and builds commands from data sent by clients without checking it. An attacker who can reach it may be able to run any command on the machine as root, without logging in.

1. How it works:
2. Attacker connects
3. Unquoted command built
4. Command runs as root
5. Host compromised
6. Attacker controls the server as root

A feature that shortens long chats with OpenAI's AI models could be misused to read the model's private reasoning, which is normally hidden from users. Competitors could use that to copy the model more cheaply.

1. How it works:
2. Attacker uses compaction
3. Reasoning exposed
4. Traces copied
5. Rival model distilled
6. Hidden AI reasoning is copied

A shared secret key used for trust between devices can be stolen or reused, letting an attacker log into the device as the top-level administrator. That gives full control of the device.

Attackers on the network can send specially crafted input to a WolfProt service without logging in and make the server run commands of their choosing. This can give them control over the machine running the service.

1. How it works:
2. Unauthenticated attacker
3. Reaches WolfProt service
4. Malicious input sent
5. OS command executed
6. Attacker controls the server

Any logged-in user allowed to import campaigns can upload a file that the web server will run as a program. That lets an attacker take over the server and read its settings and contact data.

1. How it works:
2. Authenticated user
3. Crafted campaign archive
4. Files copied unchecked
5. Script in web root
6. Attacker controls the server

Someone on the internet without a password can trick the platform's login system into treating them as a real user, including an administrator. They can then read and change sensitive records.

1. How it works:
2. Unauthenticated attacker
3. Login service flaw
4. Session as any user
5. Sensitive data access
6. Attacker takes over accounts and data

Attackers can get past the login screen of Fortinet's FortiSandbox security appliance by sending specially crafted web requests. Once past it, they may be able to run commands on the device.

1. How it works:
2. Attacker sends request
3. Login is bypassed
4. Commands execute
5. Attacker controls the FortiSandbox device

rclone is a tool that copies and syncs files to cloud storage. Attackers can exploit several bugs in it to read or change your files, crash it, or bypass security checks.

Netty is a networking library used by many Java applications. Attackers could get around security checks, tamper with requests, or overload services so they stop working.

A widely used XML parsing library has a bug that lets an attacker make programs that use it stop working. The attacker does not get into your data, but your service can go down.

expat is a widely used library that reads XML data inside many programs. Attackers can send specially crafted XML to crash those programs, read data they should not see, or in some cases run their own code.

1. How it works:
2. Attacker sends XML
3. Parser flaw triggered
4. Memory or data exposed
5. Crash or code run
6. Application crashes or attacker gains control

A flaw in the Emacs text editor could let someone who already has a login on the computer run their own commands with the same rights as the user. It does not let attackers in from the internet directly.

1. How it works:
2. Local access
3. Emacs flaw
4. Code runs
5. Attacker runs code as the local user

Several software components on Red Hat Enterprise Linux have security holes. Attackers could possibly crash services, read private data, or gain more control of the system.

Someone who already has a login on the computer could abuse a bug in QEMU, a virtualization tool, to run their own programs as your user account. From there they could bypass some security checks and read or change data.

1. How it works:
2. Local attacker
3. QEMU bug
4. Code execution
5. Data at risk
6. Attacker runs code as your user

Ghostscript is a tool that reads and converts PDF and PostScript files. A flaw lets an anonymous attacker from the internet run their own commands on a computer that processes a crafted file.

1. How it works:
2. Attacker
3. Malicious file
4. Ghostscript processes it
5. Code runs
6. Attacker gains code execution on the server

Many separate security flaws in the Linux operating system kernel (the core of the system) were found. Depending on the flaw, an attacker could crash a machine, read private data, or gain higher privileges.

Attackers can exploit several flaws in the Linux operating system core, which may let them bypass security checks, crash the system, or in some cases gain full control. Installing the vendor's kernel updates closes these gaps.

Someone with a valid login to OpenShift could run their own program on the system and see information they should not have. The attacker must already have an account, so it is not an open-to-anyone attack.

The Linux kernel, the core of many servers and devices, has several security bugs. Attackers could crash systems or possibly corrupt memory, and some flaws may be reachable remotely.

Attackers who can reach or run code on a Linux machine may crash it or, in some cases, gain full control. Updating the kernel closes these holes.

ImageMagick is a tool that many websites and programs use to process pictures. Attackers can abuse these flaws to take control of the service, crash it, or read data it should keep private.

1. How it works:
2. Attacker sends image
3. ImageMagick processes it
4. Memory is corrupted
5. Code runs
6. Attacker controls the server or service

The Rocq proof assistant, used to check math and software proofs, can be tricked into accepting a proof of a false statement such as 0 = 1. This means a 'verified' proof may be wrong without any warning.

1. How it works:
2. Module disables check
3. Module closes
4. Kernel accepts bad terms
5. Proof of False derived
6. False proofs accepted as valid

The Lean 4 system is used to check that mathematical or software proofs are correct. A flaw lets a crafted program make the checker accept a bogus proof, including one that claims 0 = 1, so a "verified" result cannot be trusted.

1. How it works:
2. Malicious dependency
3. Project build
4. Ill-typed declaration
5. Kernel accepts proof
6. False proofs pass verification

Attackers who can get you to load a malicious web page may be able to run their own code on your computer or crash the browser. Updating the software closes these holes.

1. How it works:
2. Attacker
3. Web content
4. WebKitGTK
5. Code runs
6. Attacker may run code on the device

Attackers are actively using a serious weakness in F5 BIG-IP APM, a device that controls who can log in to a company's internal systems. If left unpatched, an outsider could potentially get into systems they should not reach.

IBM App Connect Enterprise is software that links business applications together. Several weaknesses in it could let an attacker bypass protections, crash the service, read data, change files, or run their own code.

Qt is a software toolkit used to build many desktop and embedded programs. Attackers over the network may be able to crash affected programs, and some flaws may also expose or change data.

ClamAV is a free antivirus scanner. Attackers on the network can exploit these flaws to crash the scanner or read data they should not see.

expat is a widely used library that reads XML data inside many programs. A flaw in it can let an anonymous attacker send malicious XML and make the program crash or stop responding.

zlib is a common library that many programs use to shrink and unpack data. A flaw in it can let an attacker crash a program or, in some cases, run their own code on the machine.

1. How it works:
2. Attacker sends crafted data
3. Data reaches zlib
4. Heap buffer overflow
5. Program crashes or is hijacked
6. Service disrupted or attacker runs code

A flaw in the OpenJPEG image library can let an attacker crash programs that encode JPEG 2000 images. The program stops working until it is restarted.

1. How it works:
2. Attacker
3. Encoder
4. Overflow
5. Crash
6. Denial of service on encoding service

A weakness in the security code that Java uses for encrypted connections can let an outside attacker read or change data without logging in. Anything running affected Java versions over a network is at risk.

1. How it works:
2. Remote attacker
3. Network request
4. Java JSSE API
5. Critical data
6. Attacker reads or changes critical data

A flaw in Postiz lets a logged-in user create their own valid security tokens and use them as if the system had issued them. This can let them log in as someone else or grant themselves higher access.

1. How it works:
2. Logged-in user
3. Channel refresh route
4. Shared signing secret
5. Forged token
6. Attacker gains another user's or higher access

A logged-in user can trick the app into reading private files stored on its server, such as configuration or secret keys, and sending them out through a Discord message. Anyone who can sign up may be able to do this.

1. How it works:
2. Registered user
3. Crafted media path
4. Publishing worker
5. File sent out
6. Server files leak to attacker's Discord

A flaw in this WordPress newsletter plugin lets an attacker send specially crafted data that the site then trusts and processes. This can let the attacker take control of the website.

1. How it works:
2. Attacker
3. Vulnerable plugin
4. Server
5. Site data
6. Attacker gains control of the website

A flaw in the Paytium plugin for WordPress lets an attacker send specially crafted data that the website then processes unsafely. This can let an outsider take control of or damage the website.

A WordPress plugin for filtering shop products has a flaw that lets outsiders sneak commands into the site's database. Attackers can slowly read or change stored data, such as customer or order information, without a visible error.

1. How it works:
2. Attacker
3. Filter request
4. SQL query
5. Hidden data
6. Attacker reads or alters store data

Attackers can send specially crafted input to the newsletter plugin and make it run database commands they wrote. This can expose or change the website's stored data, including subscriber information.

Attackers can hide a specially crafted message in a normal blog comment. When an administrator later runs a backup or restore with this plugin, the plugin can be tricked into running that hidden message as code on the website's server.

1. How it works:
2. Attacker posts comment
3. Stored in database
4. Admin runs backup
5. Unsafe unserialize()
6. Attacker controls the WordPress server

Some web servers that use the HTTP/2 connection method have a flaw that could let an outsider run commands on the server. Someone exploiting it could take control of the machine.

Any user with a normal account can make the server reveal its secret settings, such as the keys that protect logins and passwords for connected services. A single request can also shut the server down.

1. How it works:
2. Attacker registers
3. Signed-in request
4. Backend reads file
5. Secrets exposed
6. Attacker gets server secrets or crashes it

A specially built model archive can trick the server into writing files outside its folder, which can let an outsider run their own code on the machine. The product is retired and no fix is coming.

1. How it works:
2. Attacker crafts archive
3. Archive uploaded
4. Unsafe extraction
5. Code executed
6. Attacker runs code on the server

A helper package for managing Docker containers has a bug that could let an outside attacker run their own commands on the computer using it. Anyone who uses this package should update or stop using it until a fix is confirmed.

A small npm package that helps AI assistants work with Git can be abused by an outside attacker to run their own commands on the computer using it. If you use this package, someone could take control of that machine.

A tool that lets AI assistants run SageMath math code could let an outside attacker run their own commands on the machine it runs on. The safety checks meant to block this are not strong enough.

1. How it works:
2. Attacker sends input
3. Sanitizer fails
4. Shell command runs
5. Attacker runs code on the server

Attackers without any login can send specially crafted input to the website's template system and run their own commands on the server. That can let them take over the site and what it stores.

1. How it works:
2. Attacker
3. Crafted request
4. Template engine
5. Code runs
6. Attacker controls the server

Anyone who can plug a cable into the CrystalSky, or reach it over the network once a debug feature is turned on, can get command-line control of the device without a password. That is a serious takeover risk.

1. How it works:
2. Attacker nearby
3. ADB reachable
4. adbd accepts connection
5. Unauthenticated shell
6. Attacker gains command control of device

A flaw in the Little Birdies theme lets an attacker send specially crafted data that the website trusts and processes unsafely. In the worst case, this can let someone take control of the site.

1. How it works:
2. Attacker sends crafted data
3. Theme processes input
4. Malicious object injected
5. Code runs on server
6. Attacker may take control of the site

Attackers can send specially crafted data to the Rhodos WordPress theme and make the website run their commands. That can let them take over the site or reach its data.

1. How it works:
2. Attacker
3. Website request
4. Unsafe object handling
5. Code execution
6. Attacker controls the website server

Attackers may be able to send specially crafted data to a website using the Reprizo theme and make it run commands they choose. This can let them take over the site.

Attackers can send specially crafted data to the theme and make the website run instructions they chose. Think of it as tricking the site into obeying a hidden command.

1. How it works:
2. Attacker sends data
3. Theme unserializes it
4. Malicious object created
5. Site compromised
6. Attacker controls the website

A flaw in the Redy WordPress theme lets an attacker feed it specially crafted data that the site then processes as commands. This can let strangers take control of the website.

1. How it works:
2. Attacker
3. Redy theme
4. Object injection
5. Code execution
6. Attacker controls the website server

A flaw in this WordPress theme lets attackers send specially crafted data that the website then trusts and processes, which can let them take over parts of the site. Think of it as a lock that accepts a forged key.

1. How it works:
2. Attacker sends crafted data
3. Theme unserializes input
4. Malicious object executes
5. Attacker gains control of the website

A flaw in this WordPress theme lets an attacker send specially crafted data that the site trusts and processes unsafely. This can let them take control of the website.

Attackers may be able to send specially crafted data to the HotLock website component, which could let them run harmful code or take control of the site. Think of it as a lock whose key-reading mechanism can be tricked.

1. How it works:
2. Attacker
3. Website request
4. HotLock plugin
5. Object injection
6. Attacker may control the website server

Hostme v2 accepts data that it does not check properly. An attacker who sends specially crafted data could make the website run code they chose, which can give them control of the site.

A flaw in the ZenSoul theme lets an outsider send specially crafted data that the website trusts and processes unsafely. This can let an attacker take control of parts of the site.

Attackers can send specially crafted data to the Save Life theme that makes the website process it in a dangerous way. This can let them take control of or damage the site.

1. How it works:
2. Attacker
3. Website request
4. Theme processes data
5. Code runs on server
6. Attacker may take control of the site

Under a rare combination of settings and app code, an attacker could make a PHP website run commands on its server. PHP says the setting to turn off is a simple switch, and no emergency update is out yet.

1. How it works:
2. Attacker sends request
3. App switches handler
4. Session data parsed
5. Code runs on server
6. Attacker runs code on the web server

Attackers may be able to send specially crafted data to this WordPress plugin and make it run harmful code on your website. This could let them take control of the site.

1. How it works:
2. Attacker
3. Public request
4. Plugin
5. Website
6. Attacker may control the website

Attackers can send specially crafted input to this WordPress plugin and read data from the site's database, such as member details. The plugin does not properly check what users send it.

1. How it works:
2. Attacker
3. Public web form
4. Database query
5. Data extracted
6. Attacker reads site database contents

A user account with low privileges on a CGM CLININET system can change files that a root-level service reads and runs. That lets them take full control of the machine.

1. How it works:
2. Local low-privilege user
3. Modify service files
4. HL7 service runs
5. Malicious code executes
6. Attacker gains root control of the system

A medical records server accepts messages from other hospital systems, and its message handlers run with full administrator power. An attacker on the same network could send a crafted message and take complete control of the server.

1. How it works:
2. Attacker on network
3. Crafted HL7 message
4. HL7 process parses it
5. Code runs as root
6. Attacker controls the server

Attackers who can reach the learning platform over the network can get in without a password or OAuth login, by sending one specially crafted web request. They may then act as any user, including administrators.

1. How it works:
2. Remote attacker
3. Crafted POST request
4. Auth bypassed
5. Session granted
6. Attacker gains full admin control

The device does not properly check that its firmware (its built-in software) is genuine. An attacker could load a modified version onto the speaker or sound device, which could then behave in ways its owner did not intend.

An administrator who logs into the Okta Access Gateway admin console could type specially crafted settings that make the server run commands it should not. That means one admin account could take more control of the server than intended.

1. How it works:
2. Admin account
3. Admin Console
4. Input processed
5. Command runs
6. Attacker runs commands on the gateway server

A flaw in a public sign-up form lets an outsider log in as an existing user, including someone with admin rights. From there, the attacker could run commands on the server itself.

1. How it works:
2. Remote attacker
3. Registration form
4. Login bypassed
5. Admin privileges
6. Attacker controls the server

A user who can log into the encoder's web settings can slip extra commands into a network setting. Those commands then run with full control of the device.

1. How it works:
2. Authenticated user
3. Crafted interface name
4. Unvalidated shell command
5. Code runs as root
6. Attacker gains root control of the encoder

A logged-in user of the device's web page can slip extra commands into the device name field. The device then runs those commands with full control, so an attacker could take over the encoder.

1. How it works:
2. Logged-in user
3. Device name field
4. Shell command runs
5. Injected commands
6. Attacker gains root on the encoder

By default, data sent to and from this health-data platform is not encrypted. Someone on the same network path could read it and potentially reuse login details to get into the system.

1. How it works:
2. Traffic crosses network
3. Attacker observes traffic
4. Credentials reused
5. Device accessed
6. Attacker logs into the health data system

A user with access to the device's web settings can plant a command that runs with full control of the device, and it keeps running after restarts. An attacker could then take over the encoder and read stored passwords and keys.

1. How it works:
2. Authenticated user
3. Web management API
4. Network service
5. Persistent root command
6. Attacker gains full root control of device

A flaw in how Aruba AOS-10 wireless equipment handles Wi-Fi traffic could let someone nearby, without logging in, pull out sensitive data. That data could help them reach other network services or disrupt the device.

1. How it works:
2. Nearby attacker
3. Crafted Wi-Fi frames
4. Frame processing flaw
5. Information retrieved
6. Sensitive data exposed to nearby attacker

Attackers on the same local network segment can get past the login check without a password. Once inside, they could take full control of the device and the data it handles.

1. How it works:
2. Adjacent attacker
3. Sends PAPI requests
4. Authentication bypassed
5. Controller accessed
6. Attacker gains administrative control

A flaw in the AOS-10 management API lets someone nearby, without a password, get past the login check. They could then take over the device, change its settings, and read or change sensitive data.

1. How it works:
2. Adjacent network
3. AOS-10 API
4. Auth bypass
5. Admin access
6. Attacker gains administrative control

Someone on the same local network as an affected Aruba AOS-10 device could skip the login check. They could then gain full admin control of the device and change its settings or read sensitive data.

1. How it works:
2. Adjacent attacker
3. PAPI protocol
4. Auth bypassed
5. Admin access
6. Attacker controls the network device

A flaw in the core operating system of AOS lets someone outside the network run their own commands on the device without logging in. That gives them full control of the device.

1. How it works:
2. Remote attacker
3. Crafted network input
4. Buffer overflow
5. Code runs as root
6. Attacker gains full control of the device

A login-free remote attacker can pull sensitive details from the device's command line interface. Those details could help them break into other network services on the device.

1. How it works:
2. Remote attacker
3. Reaches CLI
4. Sensitive info leaked
5. Further access
6. Attacker gains footing in network services

An attacker on the same local network can skip the login check on certain Aruba AOS-8 network devices and take control of them without a password. From there they could change settings or reach sensitive data.

1. How it works:
2. Attacker on network
3. Sends PAPI request
4. Login check skipped
5. Admin access gained
6. Attacker controls the network controller

An attacker on the same local network could skip the login check on the AOS-10 management interface. From there they could run commands on the device's operating system with full admin rights.

1. How it works:
2. Adjacent attacker
3. Auth bypass
4. AOS-10 interface
5. Command execution
6. Attacker controls the device

Attackers on the same local network could skip the login step and take full control of the device. From there they could change settings or read sensitive data.

1. How it works:
2. Adjacent attacker
3. Reaches interface
4. Bypasses login
5. Gains admin rights
6. Attacker fully controls the controller

A flaw lets someone nearby, without logging in, get past the login check on the device and run their own commands on it. That can take over the whole device.

1. How it works:
2. Nearby attacker
3. Adjacent network access
4. Auth check bypassed
5. Commands executed
6. Attacker gains complete control of the device

An attacker on the same local network can, without logging in, read, change, or delete files on the network device's operating system. This could let them take control of the device or disrupt the network.

1. How it works:
2. Adjacent attacker
3. Sends PAPI request
4. Path traversal
5. Read or change files
6. Attacker gains file control on the device

A flaw in AOS-10 (network equipment software) lets someone on the nearby network take control of the device without logging in. The attacker could then run their own commands with the highest level of access on the device.

1. How it works:
2. Nearby attacker
3. Crafted input
4. Memory corruption
5. Privileged code runs
6. Attacker controls the device OS

An attacker on the same local network can send crafted input to a device's management interface and make it run commands on the device's operating system. No login is needed, so anyone nearby who can reach it could try.

1. How it works:
2. Nearby attacker
3. Crafted request
4. Input not sanitized
5. Commands executed
6. Attacker controls the underlying operating system

A flaw in certain network devices lets someone nearby, without a password, send crafted data that takes control of the device. An attacker could then run their own commands with full administrator rights on the device.

1. How it works:
2. Nearby attacker
3. Crafted data sent
4. Buffer overflow
5. Code execution
6. Attacker controls the network device

A flaw in certain Aruba network controller software lets someone nearby, without logging in, send specially crafted data that can run their own code on the device. The attacker could then gain full control of the underlying system.

1. How it works:
2. Nearby attacker
3. Crafted data sent
4. Buffer overflow
5. Privileged code runs
6. Attacker controls the controller

Attackers can send specially crafted network messages to certain AOS-10 Aruba devices and run their own commands on them, with no password needed. That gives them full control of the device, which could be used to spy on or disrupt the netw

1. How it works:
2. Attacker sends packets
3. Device reached
4. Command injected
5. Code runs as root
6. Attacker controls the network device

Attackers can send specially crafted network packets to certain Aruba AOS-8 network controllers and run their own code on them, without needing a password. Anyone who controls the device could then see or change network traffic.

1. How it works:
2. Attacker sends packets
3. PAPI service receives
4. Buffer overflow occurs
5. Arbitrary code runs
6. Attacker controls the controller

An attacker on the network can send a specially crafted request that makes the device run their own commands, with no password needed. This gives them full control of the device.

1. How it works:
2. Attacker on network
3. AOS-8 interface
4. Code execution
5. Privileged access
6. Attacker controls the device

Someone on the network, with no password, could send specially crafted messages to the device and read or change its stored data, or knock the service offline. The flaw is in how the device handles input to its database.

1. How it works:
2. Remote attacker
3. PAPI request
4. SQL injection
5. Data exposed
6. Attacker reads, alters data, or disrupts service

Attackers on the network can send specially crafted messages to certain Aruba AOS-8 devices and take control of them without logging in. The device can then be used to run any command as an administrator.

1. How it works:
2. Attacker on network
3. PAPI UDP port
4. Command injection
5. Code runs as root
6. Attacker controls the controller

A weakness in how AOS-8 network devices handle a management protocol could let someone outside your network take over the device without a password. Attackers could then change settings or read sensitive data.

1. How it works:
2. Remote attacker
3. PAPI protocol
4. Authentication bypassed
5. Admin access gained
6. Attacker controls the AOS-8 device

A flaw in the remote-login service on AOS-8 devices lets an outsider get past the password check without logging in. Once in, they can take full control of the device.

1. How it works:
2. Remote attacker
3. Reaches SSH daemon
4. Authentication bypassed
5. Admin privileges gained
6. Attacker fully controls the AOS-8 host

Someone on the internet with no login could send specially crafted input to AOS-10 and make its database run their commands. From there they could take control of the underlying operating system.

1. How it works:
2. Unauthenticated attacker
3. Crafted request sent
4. SQL injection
5. OS command execution
6. Attacker controls the AOS-10 host

An attacker on the internet with no login could pull sensitive information from the device and possibly run commands on it. This is a serious flaw that could let someone take over the device.

1. How it works:
2. Remote attacker
3. Reaches interface
4. Sensitive data leaked
5. Commands executed
6. Attacker may control the device

Attackers on the internet can send specially crafted input to the AOS web admin page without logging in. This can let them read or change data and possibly run commands on the device.

1. How it works:
2. Remote attacker
3. Sends crafted request
4. AOS web interface
5. SQL injection
6. Attacker runs commands on the system

A flaw in the AOS-10 software lets an attacker send specially crafted data to the device and run their own commands on it, with no password needed. The attacker could then fully control the device.

Attackers on the network can get past the login check on an affected Aruba AOS-8 device and run commands on it with full control. That means they could take over the whole device.

1. How it works:
2. Remote attacker
3. Vulnerable interface
4. Authentication bypassed
5. Commands executed
6. Attacker gains root control of device

An attacker on the network, without needing a password, can send crafted input that tricks the device into running its own commands. That can give them full control of the network device.

1. How it works:
2. Remote attacker
3. Vulnerable interface
4. SQL injection
5. OS command execution
6. Attacker controls the AOS-8 device

Anyone on the internet who can reach the affected management interface can send crafted input that makes the device run commands for them. The device could then be fully controlled by the attacker.

1. How it works:
2. Unauthenticated attacker
3. Crafted web request
4. SQL injection
5. OS command execution
6. Attacker controls the AOS-8 device

Attackers on the network can send specially crafted data to certain AOS-10 network devices and run their own commands with full control. No password is needed.

1. How it works:
2. Attacker on network
3. Vulnerable interface
4. Device OS
5. Attacker controls the device

Attackers on the network could potentially run commands on the device's underlying system without logging in, if certain conditions outside their control are met. Taking over the device could expose the network it manages.

Attackers without a login may be able to get past the sign-in check on AOS-10 and run commands on the underlying system. This only works if certain conditions outside the attacker's control are true.

1. How it works:
2. Remote attacker
3. Reaches interface
4. Bypasses auth
5. Runs commands
6. Attacker controls the underlying host

A flaw in the software that starts a server before its operating system can let an attacker on the network take control of the machine. The attacker does not need a password.

1. How it works:
2. Attacker on network
3. Server PXE boots
4. Buffer overflow
5. Code runs at boot
6. Attacker controls the server

Some Linux computers can share files with Windows-style network shares. Two serious bugs in that sharing feature could let an outsider run their own code on the machine, and one of them needs no login.

1. How it works:
2. Attacker sends crafted traffic
3. Reaches SMB port
4. Flaw triggers in kernel
5. Code runs on server
6. Attacker controls the Linux server

Azure Pipelines is Microsoft's service that runs software build and deployment jobs. A flaw lets an outside attacker, with no login, send specially crafted input over the network and make the service run commands of their choice.

A logged-in user of Azure AI Foundry can trick the service into making requests it should not make, which can give them more access than they should have. Only accounts that already have some access are at risk.

1. How it works:
2. Authorized user
3. Forged request
4. Service acts for attacker
5. Privilege gained
6. Attacker gains elevated privileges

A tool that checks Azure virtual machines can be tricked into following a fake shortcut to a file. An outside attacker over the network could use this to gain more control than they should have.

1. How it works:
2. Remote attacker
3. VM Inspector
4. File access
5. Privilege gain
6. Attacker gains elevated privileges on the VM

A management service for Azure Kubernetes clusters does not check who is asking before doing a sensitive task. Someone on the network with no login could use this to take on higher-level control.

A weakness in Microsoft's cloud email service could let someone who already has an account there run harmful code on Microsoft's servers. Microsoft manages the service, so most organizations have little to do beyond checking for official no

1. How it works:
2. Authorized user
3. Crafted request
4. Buffer overflow
5. Code execution
6. Attacker runs code on Exchange Online

A weakness in Microsoft's Azure AD Application Proxy lets someone without valid login rights get more access than they should. An attacker on the network could potentially take control of parts of the system.

1. How it works:
2. Unauthenticated attacker
3. Reaches App Proxy
4. Authentication bypassed
5. Privileges elevated
6. Attacker gains elevated privileges

Someone on the internet with no login can trick the site into saving a hidden script file that the server then runs. That lets them take control of the website.

1. How it works:
2. Anonymous attacker
3. Reuses public image URL
4. Image handler accepts changes
5. Writes hidden PHP file
6. Attacker controls the web server

A flaw in the Rootblox theme lets someone trick the website into loading a file it should not load. This can let an outsider read sensitive server files or run harmful code on the site.

1. How it works:
2. Attacker sends request
3. Theme includes file
4. Server loads local file
5. Data exposed
6. Attacker reads or runs server files

Attackers can send a specially crafted web request that makes the website run their own code and commands on the server, with no login needed. This can give them full control of the site.

1. How it works:
2. Attacker sends request
3. Site builds template
4. Code gets executed
5. Commands run on server
6. Attacker controls the server

Anyone on the internet can trick FineReport into saving a malicious web page onto the server, then open that page to take control of the server. No password is needed.

1. How it works:
2. Unauthenticated attacker
3. Crafted POST request
4. design_save_svg writes file
5. JSP webshell planted
6. Attacker controls the server

Attackers can send specially crafted input to the Amelia booking plugin and read or change the data stored in the website's database, such as customer bookings and personal details.

Attackers can pretend to be a trusted user and get past the login check on the SureCart plugin for WordPress. This could let them into areas they should not be able to reach.

The NT OneAPP app does not check that it is really talking to its real server. An attacker on the same network could pretend to be the server, read what is sent, and change it.

1. How it works:
2. Attacker on network
3. Traffic intercepted
4. Fake server accepted
5. Data read or changed
6. Attacker reads or alters app traffic

NT OneAPP has a secret encryption key written directly into the software. Anyone who finds it can unscramble login requests and read usernames and passwords sent by users.

1. How it works:
2. Remote attacker
3. Captures login request
4. Uses built-in key
5. Decrypts request
6. Attacker gains users' account credentials

A flaw in a Drupal form add-on lets an attacker slip in their own code through form templates. That code can then run on your website's server.

A flaw in this TOTOLINK router lets an outside attacker send a specially crafted request that makes the device run commands they choose. Anyone on the internet may be able to reach it.

1. How it works:
2. Remote attacker
3. Internet request
4. Router firmware
5. Command runs
6. Attacker controls the router

Java software from Oracle has a flaw in how it handles secure network connections. An attacker on the network could potentially read or change data without logging in.

1. How it works:
2. Remote attacker
3. Exposed web service
4. Flawed JSSE component
5. Critical data
6. Attacker reads or alters critical data

Attackers on your network can send a specially crafted request to this Wi-Fi range extender, which can overwrite memory on the device. This can let them crash it or potentially run their own commands on it.

1. How it works:
2. Remote attacker
3. Web interface
4. Wireless ACL handler
5. Stack overflow
6. Device crashes or attacker gains control

Attackers on the network can send a specially crafted request to this Wi-Fi range extender that overflows its memory, which can crash it or let them run their own commands. Public exploit code exists.

1. How it works:
2. Attacker
3. Web interface
4. Overflow
5. Router
6. Attacker controls the extender

Pulsar Manager is a web control panel for Pulsar message clusters. Anyone who can reach it over the network can take it over and reach the cluster behind it, and the project will not release a fix.

1. How it works:
2. Attacker reaches console
3. Creates admin account
4. Proxies admin requests
5. Credential sent out
6. Attacker controls the Pulsar cluster

Someone who copies a valid login token from your router's web admin page can reuse it to get admin access, and the access keeps working until the router's token list is manually cleared. This lets an attacker take over the router without kn

1. How it works:
2. Traffic intercepted
3. Token replayed
4. Router login accepted
5. Persistent admin access
6. Attacker gains persistent router admin access

Someone could make the LocalAI server reach out to private parts of your network or cloud account on their behalf, and read what comes back. This can expose internal data such as cloud credentials.

1. How it works:
2. Attacker submits URL
3. Initial URL passes check
4. Server follows redirect
5. Metadata response returned
6. Attacker reads internal and cloud data

GStreamer is a library many apps use to play audio and video. A specially crafted network stream can overflow memory in its RTP handling, which may let an attacker crash the app or run their own code on the machine.

1. How it works:
2. Attacker
3. Network stream
4. rtpL16depay
5. Heap overflow
6. Attacker may run code in the app

Attackers on the network who obtain certain login cookies can take full control of the device. Some certificate checks in clustering are also skipped, making this easier.

1. How it works:
2. Attacker on network
3. Steals persistent cookies
4. Calls database service RPC
5. Runs commands as root
6. Attacker controls the appliance as root

A flaw in this WordPress search plugin lets an outsider sneak database commands through the search box. That can expose or change the site's stored data, such as user accounts.

A flaw in the Mang Board WP plugin for WordPress lets an outsider upload a hidden program to the website. That program can let them take control of the site.

1. How it works:
2. Attacker
3. Plugin upload
4. Web shell saved
5. Remote access
6. Attacker controls the web server