Attackers on the network can send a specially crafted request to the router's web interface that overwrites part of its memory. This can crash the router or let an attacker run their own commands on it.

1. How it works:
2. Attacker sends request
3. Request reaches router
4. Unsafe copy overflows
5. Router compromised
6. Attacker may control the router

Someone on the network could send a specially crafted request to this Wi-Fi router and crash it or potentially take control of it. Public exploit code exists.

1. How it works:
2. Attacker sends request
3. Request reaches handler
4. Unsafe copy overflows stack
5. Router compromised
6. Attacker may control the router

Attackers on the network can send specially crafted requests to this Wi-Fi router and make it run commands they choose. That can give them control of the device.

1. How it works:
2. Attacker sends request
3. Reaches router
4. Input not sanitized
5. Commands execute
6. Attacker controls the router

Someone on the internet could send a specially crafted request to this router and make it run commands they choose. That could let them take control of the device.

1. How it works:
2. Attacker sends request
3. Request reaches router
4. Input not sanitized
5. Command executes
6. Attacker runs commands on the router

Attackers can send a specially crafted request to this router and make it run commands they choose. That could let them take over the device.

1. How it works:
2. Attacker sends request
3. Router parses input
4. Injected command runs
5. Device compromised
6. Attacker controls the router

Attackers on the network can send a crafted request to the router's web settings page and make it run commands on the router. A public exploit exists.

1. How it works:
2. Attacker sends request
3. Request reaches router
4. Input not sanitized
5. Commands execute
6. Attacker controls the router

Attackers may be able to sneak database commands through the booking plugin's inputs, which could expose or change website data. Update the plugin to a fixed version as soon as one is available.

Someone on the network could send a specially crafted request to this router and make it run commands they choose. Public exploit code exists, so attacks are possible.

1. How it works:
2. Attacker sends request
3. Request reaches router
4. Input not sanitized
5. Injected command runs
6. Attacker can run commands on router

Attackers on the network can send a specially crafted setup request to this router and make it run commands they choose. That can let them take control of the device.

1. How it works:
2. Attacker sends request
3. Reaches router remotely
4. Input not sanitized
5. Commands execute on device
6. Attacker controls the router

Someone on the internet may be able to send a specially crafted file upload to this router and crash it or take control of it. A public exploit is reported to exist.

1. How it works:
2. Attacker sends crafted upload
3. TFTP upload handler
4. Stack buffer overflow
5. Router memory corrupted
6. Router may crash or be taken over

Anyone who knows a secret password hard-coded in the software can forge access passes and then run their own commands on the server without logging in. Attackers can take over the server.

1. How it works:
2. Attacker forges token
3. Forged share token
4. testTransform endpoint
5. Script runs via Groovy
6. Attacker controls the server

Jpom is a web tool for managing servers. A crafted request header can trick it into granting full admin rights to anyone, with no password needed. From there, attackers can run commands on the server.

1. How it works:
2. Unauthenticated attacker
3. Malicious token header
4. Condition parser runs
5. Super-admin granted
6. Attacker controls the Jpom server

Visitors to a page with a SimpleForm form can upload files that the website server may run as programs. That can let an outsider take control of the website.

1. How it works:
2. Attacker finds form
3. Nonce read from page
4. Trailing-dot file upload
5. Server stores executable file
6. Attacker may run code on the server

A flaw in this WordPress quiz and course plugin lets users with a basic account delete files on the website's server. Deleting a key settings file can let an attacker take over the whole site.

1. How it works:
2. Attacker sends request
3. Plugin route accepts path
4. Arbitrary file deleted
5. Site takeover possible
6. Attacker can run code on the server

Someone who knows a user's password can log in to that account even when the site has not approved it or has suspended it. No prior login is needed.

1. How it works:
2. Attacker has password
3. Crafted login request
4. Verification check skipped
5. Session cookie issued
6. Attacker logs into unverified or suspended account

A WordPress plugin for managing projects has a flaw that lets people with no login run commands on the website's server. That can let them take over the site and its data.

1. How it works:
2. Unauthenticated attacker
3. Crafted REST request
4. WordPress runs validation
5. PHP functions invoked
6. Attacker executes code on the server

A networking library can be tricked into running an attacker's code when it reads data from an untrusted source. The flaw is in how it unpacks certain incoming messages, and there is no planned fix for this version line.

1. How it works:
2. Attacker crafts payload
3. Payload sent to service
4. Decoder reads frame
5. Code runs on server
6. Attacker controls the server

Anyone on the internet can send a single web request that moves all your published popups to the trash, without logging in. Your popups stop showing to visitors until someone restores them.

1. How it works:
2. Attacker sends request
3. Missing authorization check
4. Preview parameter flaw
5. All popups trashed
6. All published popups moved to trash

A WordPress booking plugin lets any logged-in user, even a basic subscriber, delete booking calendar notes that belong to others. Someone could remove important notes without permission.

1. How it works:
2. Subscriber logs in
3. Calls remove-note action
4. No capability check
5. Calendar note deleted
6. Booking calendar notes are deleted by unauthorized users

A flaw in a WordPress invoice plugin lets someone with no login run harmful code on the store's server by placing a checkout order. Store owners using the affected versions need to act.

1. How it works:
2. Attacker places order
3. Request sent to store
4. Note reaches invoice code
5. Malicious data deserialized
6. Attacker executes code on the server

A flaw in the LeadSnap plugin lets an outside visitor send specially crafted data that makes the website run commands it should not run. Anyone who can reach the site can try it, with no password needed.

1. How it works:
2. Attacker
3. Public site
4. Object injection
5. Code execution
6. Attacker controls the website server

Anyone on the internet can send specially crafted data to this WordPress plugin and potentially run code on the site without logging in. Site owners using the affected version should update right away.

Anyone on the internet can send specially crafted input to the Transliterator component and make the website's database run commands the site owner never intended. This could expose or change stored data without logging in.

1. How it works:
2. Anonymous attacker
3. Crafted request
4. Transliterator flaw
5. SQL executed
6. Attacker reads or alters database data

A flaw lets an attacker send specially crafted data to the Royal Event theme that the website then trusts and processes. This can let the attacker take control of the website.

A flaw in the Widget Options plugin could let an outside attacker run their own commands on the website's server. That can mean taking over the site or stealing its data.

Anyone on the internet can, without logging in, gain higher access rights on affected WordPress sites. This could let an attacker take over parts or all of the site.

Visual Studio does not properly check whether a server's security certificate is genuine. An attacker on the same network could pretend to be a trusted server.

Programs that show translated text can be tricked into loading a translation file from a folder chosen by an attacker. A crafted file can crash the program or run attacker code with the program's permissions.

1. How it works:
2. Attacker sets env
3. Program runs
4. Loads .mo file
5. Malicious catalog
6. Program crashes or attacker runs code

Anyone with a Flowise login can slip code past the tool's safety limits and make the server run commands of their choosing. That can give them control of the machine running Flowise.

1. How it works:
2. Logged-in user
3. Custom function endpoint
4. Mammoth file write
5. vm2 sandbox escape
6. Attacker runs commands on the server

Attackers who already have a login to Ivanti Connect Secure, a remote-access VPN gateway, can upload files of their choosing to a predictable place on the server. Attackers are actively using this flaw.

1. How it works:
2. Attacker logs in
3. Uploads crafted file
4. Chains with other flaws
5. Gateway compromised
6. Attacker gains control of VPN gateway

A person who already has a login on the Ivanti VPN server can use a flaw to take over the whole server. Attackers are already using it.

1. How it works:
2. Local account holder
3. Broker trusts DSCache
4. Privilege escalation
5. Attacker gains control
6. Attacker controls the Ivanti appliance as root

If an app uses pybars4 to render Handlebars templates and lets outsiders supply or influence those templates, an attacker can make the app run their own Python code on the server. The attacker could then read or change data and take over th

1. How it works:
2. Attacker crafts template
3. App renders template
4. Code breaks out
5. Python code runs
6. Attacker executes code on the server

If an app uses pybars3 to render templates that come from users or other untrusted sources, someone could hide Python commands in the template and make the server run them. That can mean full control of the server.

1. How it works:
2. Crafted template
3. App renders template
4. Injection triggers
5. Python executes
6. Attacker runs code on the server

Anyone who can reach the LMDeploy server over the network can send it specially crafted data and make it run commands on the machine. No login is needed to do this.

1. How it works:
2. Remote attacker
3. Reaches API
4. Pickle loaded
5. Command runs
6. Attacker controls the server

vLLM is software for running AI language models on a server. Several weaknesses could let an attacker read information they should not see, change data, bypass security checks, or make the service stop working.

A weakness in Ruby on Rails, a popular framework for building websites, lets an anonymous outsider pull data they should not see. That data could help them take over more of the system.

OpenDeepWiki uses a secret key to sign login tokens, and that key is written in a public config file. Anyone who reads it can create a fake admin login and take control of the whole system without a password.

1. How it works:
2. Attacker reads config
3. Forges admin token
4. Sends token to server
5. Server accepts token
6. Attacker controls the admin functions

Attackers could find several weak spots in Red Hat's automation software. Depending on the flaw, they could gain more control than they should, read or change data, or knock the system offline.

Someone on the same network address as a user of this FTP server could potentially take over that user's file transfers, stealing downloaded files or injecting data into uploads. No password is needed for the attacker.

1. How it works:
2. Attacker on same IP
3. Obtains TLS ticket
4. Connects to PASV port
5. Steals or injects data
6. Victim's file transfers are hijacked

Attackers who can control a database sort-order (collation) setting in CakePHP can slip extra database commands into a query. That can let them read, change or delete data.

1. How it works:
2. Attacker
3. CakePHP code
4. Database query
5. Attacker runs SQL with app database rights

Attackers can slip database commands into a web app built with CakePHP through certain input fields, letting them read or change data. Apps that pass user input into database window functions are at risk.

1. How it works:
2. Attacker sends input
3. App forwards value
4. Query executes
5. Data exposed
6. Attacker runs SQL on the database

A bug in the ClickHouse database server could let someone on the network run their own commands on the machine without logging in. Under certain conditions, an attacker could take control of the server.

Someone on the internet could send a specially crafted request to this management software and make it run commands of their choosing. That would let them take control of the system without logging in.

1. How it works:
2. Attacker
3. Network access
4. Vulnerable service
5. Command execution
6. Attacker controls the server

Attackers on the internet may be able to get around protections, read data they should not see, change data, or overload the Tomcat web server so it stops working. The exact fixed versions are not named in the material.

Attackers may be able to get malicious code to run in the Edge browser just by getting you to visit something they control. Once that happens they could take more control of your computer or access data.

1. How it works:
2. Attacker
3. Lure
4. Edge flaw
5. Code runs
6. Attacker gains code execution on the device

Attackers on the internet may be able to tamper with data or crash services on affected Red Hat Linux systems. Some of the flaws could also let them bypass security checks or read private information.

Bouncy Castle is a Java library that programs use for encryption. Attackers can exploit several flaws in it to bypass security checks, read or change data, or crash the software.

Attackers who can reach the device over the network can skip the login check and make it run commands on the device itself. That can let them take over the router or switch.

1. How it works:
2. Attacker
3. Device API
4. Validation skipped
5. Command run
6. Attacker controls the router or switch

Attackers who can reach a website's form can slip in specially crafted data that the site then trusts and processes as code-like objects. On some sites this can lead to an attacker taking control of the server.

1. How it works:
2. Unauthenticated attacker
3. Gravity Forms processes input
4. Object stored in post meta
5. Gadget chain triggered
6. Attacker may gain remote code execution

Some ways of listing records in Apache Fineract let an outside user slip database commands into the sort settings. That can let them read or change data they should not see.

Attackers can send specially crafted input to a search feature and make the system run database commands they wrote. That can expose or change the financial records stored in the database.

1. How it works:
2. Attacker sends input
3. Request reaches API
4. Input not sanitized
5. Database runs attacker SQL
6. Attacker reads or alters database records

Someone on the network with no login could run their own commands on the affected server. That would give them full control of a machine that manages backup and virtualization monitoring.

1. How it works:
2. Attacker on network
3. Reaches service
4. Flaw triggered
5. Code executes
6. Attacker controls the affected server

Langflow is a tool for building AI workflows. A flaw lets someone outside your network skip the login checks and get access they should not have.

Attackers who do not have an account can send specially crafted data to Zoho Flow and make it run commands it should never run. This can let them take control of the system that runs it.

1. How it works:
2. Attacker sends request
3. App unserializes input
4. Malicious object triggers code
5. Server compromised
6. Attacker controls the server

Attackers who need no login can send specially crafted data to this software and make it run commands on the server. This could let them take over the website or its data.

1. How it works:
2. Attacker
3. Crafted request
4. Gunslinger
5. Code runs
6. Attacker may control the server

Someone on the internet can send a specially crafted request to a website using this plugin and make it do things it should not, without needing an account. This can let attackers take over the site.

1. How it works:
2. Attacker
3. Crafted request
4. Plugin unserializes input
5. Code runs on server
6. Attacker controls the website server

Someone on the internet with no login can send specially crafted data to the Gamic website software and potentially make it run code the attacker chose. This can let them take over the site.

1. How it works:
2. Attacker sends crafted data
3. Gamic unsafely unserializes input
4. Malicious object triggers code
5. Attacker gains control
6. Attacker controls the server

Attackers can send specially crafted data to the Gamezone website and make it run commands they choose, without needing a password. Anyone running this software is at risk of having their site and server taken over.

1. How it works:
2. Attacker
3. Crafted request
4. Unsafe input handling
5. Code execution
6. Attacker controls the server

A flaw in this software lets an outside attacker, with no password, send specially crafted data that makes the website run commands it should not run. In practice, the attacker could take control of the site.

1. How it works:
2. Attacker
3. Crafted request
4. Plugin unserializes data
5. Code runs on server
6. Attacker may control the website server

Attackers can send specially crafted data to the website and make it run commands they choose, without needing an account. If you use this plugin, your site could be taken over.

1. How it works:
2. Attacker sends crafted data
3. Plugin unserializes input
4. Malicious object runs
5. Server is compromised
6. Attacker controls the website server