- Exploitable by anyone able to access the site
- No mitigation
- Remote code execution
- Stealthy
- Exploits are in the wild