Cybersecurity vulnerabilities are weaknesses in software, websites, servers, networks, applications, or devices that attackers can take advantage of. These weaknesses can allow hackers to steal information, access accounts, install malware, take control of systems, or simply make a service unavailable.
You may have seen terms such as zero-day, RCE, SQL injection, XSS, privilege escalation, and CVE in cybersecurity news. While these terms are often mentioned together, they don’t all describe the same thing. Some describe how a vulnerability is discovered, while others describe what an attacker can do with it.
Understanding these terms makes it much easier to follow security news and understand the risks affecting the software you use.
Zero-Day Vulnerability
A zero-day vulnerability is a security flaw that is unknown to the software vendor or does not yet have an available fix when it becomes known or is exploited.
The name comes from the idea that the vendor has had zero days to prepare a patch.
For example, imagine researchers discover a previously unknown flaw in Google Chrome that allows an attacker to execute code simply by getting someone to visit a malicious website. If Google has not yet released a fix, this could be considered a zero-day vulnerability.
The situation becomes even more serious when attackers are already using the vulnerability in real-world attacks. This is known as zero-day exploitation.
N-Day Vulnerability
An n-day vulnerability is essentially a known vulnerability for which information or a patch is already available.
The problem is that many users and organizations don’t install security updates immediately. Attackers can take advantage of these systems even though the vulnerability is no longer a secret.
For example, Microsoft releases a security update fixing a Windows vulnerability. A company doesn’t install the update for several months. Attackers later exploit that same flaw against the company’s systems.
It may no longer be a zero-day, but the organization is still exposed.
This is one reason security updates are so important.
One-Day Vulnerability
You may also hear the term one-day vulnerability. It generally refers to a newly disclosed vulnerability where attackers may have only a short window before organizations can patch their systems.
Once details about a vulnerability become public, attackers can study the information and potentially develop an exploit.
This can create a race between attackers trying to exploit vulnerable systems and defenders trying to patch them.
The terms “one-day” and “n-day” aren’t always used consistently across the cybersecurity industry, so their exact meaning can depend on the context.
CVE
CVE stands for Common Vulnerabilities and Exposures. It is a system used to give publicly known security vulnerabilities standardized identifiers.
A CVE might look like this:
CVE-2026-12345
The CVE itself isn’t a type of vulnerability. It is an identification system.
Think of it like a reference number. When security researchers, vendors, and cybersecurity companies discuss the same vulnerability, the CVE number helps everyone know exactly which flaw they’re talking about.
A vulnerability can therefore have a CVE number and also be an RCE vulnerability, for example.
Remote Code Execution (RCE)
Remote Code Execution, usually called RCE, is one of the more serious vulnerability types.
An RCE vulnerability allows an attacker to execute their own code on a vulnerable computer or server remotely.
Depending on the affected system and the privileges available, an attacker could potentially install malware, steal information, create accounts, modify files, or take complete control of a server.
For example, if a vulnerable web application allows an attacker to send a specially crafted request that causes the server to execute commands chosen by the attacker, that could be an RCE vulnerability.
Privilege Escalation
Privilege escalation happens when an attacker gains permissions beyond what they should have.
There are two common forms.
Vertical privilege escalation happens when someone moves from a lower level of access to a higher level. For example, a normal Windows user gains administrator privileges.
Horizontal privilege escalation happens when someone accesses another account or user’s information at the same permission level.
For example, imagine a website where users can view their own account details. If changing a number in the URL allows one user to view another user’s private information, that could be a horizontal privilege escalation problem.
Privilege escalation is especially dangerous when an attacker can turn limited access into administrator or root access.
Authentication Bypass
Authentication is the process of proving who you are, usually through a username and password, passkey, security key, or another method.
An authentication bypass vulnerability allows an attacker to get around that process.
For example, a vulnerable application might accidentally allow someone to access an administrator page without providing valid credentials.
In serious cases, attackers don’t need to steal a password at all. They can exploit the vulnerability and go directly into the protected system.
Authorization Bypass
Authentication and authorization are related, but they are not the same thing.
Authentication asks:
“Who are you?”
Authorization asks:
“What are you allowed to access?”
An authorization vulnerability occurs when a system doesn’t properly enforce permissions.
For example, a normal customer might be able to change another customer’s account information simply by modifying an ID in a web request.
The attacker may be properly logged in, but the application incorrectly gives them access to something they shouldn’t be able to use.
SQL Injection
SQL Injection, commonly called SQLi, occurs when an application improperly handles user input that is used in database queries.
An attacker may be able to manipulate the database query by entering specially crafted input.
Depending on the vulnerability, this could allow attackers to access, modify, or delete database information.
Imagine a website that uses a database to store customer accounts. If the website doesn’t properly handle information entered into a login form, an attacker might be able to manipulate the database query rather than simply providing a normal username and password.
Modern development practices and prepared statements can significantly reduce this risk, but SQL injection remains an important security issue.
Cross-Site Scripting (XSS)
Cross-Site Scripting, or XSS, occurs when an attacker manages to inject malicious JavaScript into a website.
The injected script may then run in another user’s browser.
Depending on the circumstances, XSS can be used to steal sensitive information, perform actions on behalf of a victim, modify what the victim sees, or attack other users of the website.
XSS is commonly divided into stored XSS, reflected XSS, and DOM-based XSS.
Stored XSS is saved by the website and later displayed to other users. Reflected XSS is usually delivered through a request and immediately reflected by the application. DOM-based XSS happens through insecure manipulation of a webpage’s browser-side code.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery, or CSRF, tricks a user’s browser into sending an unwanted request to a website where the user is already authenticated.
For example, imagine you’re logged into a website and the site has a vulnerable account-setting function. An attacker could potentially create a malicious webpage that causes your browser to send a request to that website without you intentionally clicking the relevant button.
Modern applications commonly use protections such as CSRF tokens and appropriate cookie settings to prevent this type of attack.
Path Traversal
Path Traversal is a vulnerability that can allow attackers to access files outside the directory they are supposed to access.
Web applications often work with files stored on a server. If the application doesn’t properly validate file paths, an attacker may manipulate the path to move outside the intended folder.
In a serious case, this could expose configuration files, application source code, passwords, or other sensitive information.
File Inclusion Vulnerabilities
File inclusion vulnerabilities occur when an application allows an attacker to make it load an unintended file.
Two common categories are Local File Inclusion (LFI) and Remote File Inclusion (RFI).
LFI can allow an attacker to make an application load files already present on the server. RFI can involve loading a file from a remote location when the application is configured in a way that permits it.
Depending on the application and server configuration, file inclusion vulnerabilities can sometimes lead to information disclosure or even code execution.
File Upload Vulnerabilities
File upload functionality is common on websites. Users may upload profile pictures, documents, videos, and other files.
Problems arise when a website doesn’t properly validate uploaded files.
For example, if a website allows an attacker to upload an executable server-side script and then access it through the browser, the attacker might be able to execute code on the server.
Secure applications carefully validate file types, names, sizes, storage locations, and permissions.
Command Injection
Command injection occurs when an application takes user-controlled input and passes it to an operating system command without properly protecting it.
An attacker may then be able to add their own commands to the application’s intended command.
This can be particularly dangerous because operating system commands can provide access to files, processes, network functions, and other parts of the server.
Buffer Overflow
A buffer overflow occurs when a program writes more data into a memory area than it was designed to hold.
The extra data can overwrite nearby memory.
Depending on how the vulnerable software works, this may cause the application to crash or, in some cases, allow an attacker to execute malicious code.
Buffer overflows have been a major source of security problems for decades and remain relevant in certain types of software.
Use-After-Free
Use-After-Free is a type of memory-management vulnerability.
It happens when software continues using a section of memory after that memory has already been released.
If an attacker can manipulate the application’s memory in the right way, the flaw may potentially be turned into a more serious attack.
Use-after-free vulnerabilities are particularly important in browsers and other complex applications that handle large amounts of memory.
Race Condition
A race condition happens when the security of a program depends on the timing or order of different operations.
If an attacker can manipulate that timing, they may be able to make the application behave in an unexpected way.
For example, a website might check whether a user has permission to perform an action and then perform the action in a separate step. If an attacker can interfere between those two steps, they may be able to bypass the security check.
Denial-of-Service (DoS)
A Denial-of-Service vulnerability can allow an attacker to make a service, application, or system unavailable.
Instead of stealing information or gaining control, the attacker’s goal is to disrupt the service.
A vulnerable application might crash when it receives a specially crafted request. In other cases, an attacker may be able to consume excessive CPU, memory, network bandwidth, or other resources.
When the attack is distributed across many compromised devices, it is called a Distributed Denial-of-Service attack, or DDoS.
Information Disclosure
Information disclosure vulnerabilities cause a system to reveal information that should remain private.
That information could include usernames, internal server paths, database details, software versions, configuration information, source code, or other sensitive data.
Sometimes the information may seem harmless on its own, but attackers can combine several pieces of leaked information to build a much clearer picture of the target.
Security Misconfiguration
Not every security problem is caused by a programming bug.
Sometimes the software itself works as intended, but it has been configured incorrectly.
Examples include publicly exposed databases, unnecessary services left enabled, overly permissive file permissions, debug mode being enabled on a production website, or administrative interfaces being exposed to the internet.
Misconfiguration is particularly common because modern systems can have hundreds of settings and components.
Default or Weak Credentials
Using default or easily guessed passwords is another common security weakness.
Some devices and applications are shipped with default administrator credentials. If those credentials aren’t changed, attackers may be able to log in using publicly known information.
Weak passwords can create a similar problem.
A technically secure application can still become vulnerable if its administrator account uses a password that is easy to guess or has been reused elsewhere.
Cryptographic Vulnerabilities
Cryptography protects information such as passwords, messages, financial information, and authentication data.
A cryptographic vulnerability can occur when an application uses outdated algorithms, weak encryption, poor key management, or incorrectly implements otherwise secure cryptographic technology.
The problem isn’t always the encryption algorithm itself. Sometimes developers simply use it incorrectly.
Supply Chain Vulnerabilities
A supply chain vulnerability comes from a third-party component rather than directly from the main application.
Modern software depends heavily on libraries, packages, plugins, themes, APIs, and other external components.
If one of those components contains a vulnerability, the software using it may also become exposed.
This is why supply-chain attacks can affect thousands or even millions of users through a single compromised component.
WordPress Plugin and Theme Vulnerabilities
For WordPress websites, plugins and themes are an especially important part of the security picture.
A plugin might contain an SQL injection, authentication bypass, privilege escalation, XSS, file upload, or RCE vulnerability.
This doesn’t mean WordPress plugins are inherently unsafe. The bigger issue is that every additional plugin introduces another piece of software that needs to be maintained and updated.
Website owners should keep WordPress, plugins, and themes updated and remove software they no longer need.
Why One Vulnerability Can Lead to Another
A vulnerability doesn’t always give an attacker complete control immediately.
Attackers often combine multiple weaknesses.
For example, an attacker might first exploit an information disclosure vulnerability to learn about a server. They could then use an authentication bypass to enter an account, exploit a privilege escalation flaw to obtain administrator permissions, and finally use an RCE vulnerability to execute commands on the server.
This is why cybersecurity professionals look at the entire attack chain rather than focusing on a single vulnerability.
Zero-Day, CVE, RCE: What’s the Difference?
These terms are often mixed together in cybersecurity headlines, but they describe different things.
A zero-day describes the status of a vulnerability, particularly when a fix isn’t available or the flaw is unknown to the vendor at the time of exploitation.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
A CVE is an identifier used to reference a publicly known vulnerability.
RCE describes what an attacker may be able to achieve: executing code on the affected system.
So a single security flaw could be described as:
CVE-2026-12345 — Critical RCE vulnerability exploited as a zero-day.
In that example, CVE is the identifier, RCE describes the impact, and zero-day describes the vulnerability’s disclosure and patch status.
How to Protect Against Vulnerabilities
There is no single setting that can eliminate every vulnerability, but basic security practices can greatly reduce risk.
Keep operating systems, browsers, applications, WordPress, plugins, and themes updated. Remove software that is no longer needed. Use strong, unique passwords and multi-factor authentication where available. Restrict administrator access and regularly review user permissions.
Organizations should also use vulnerability scanning, security monitoring, backups, endpoint protection, firewalls, and a proper patch-management process.
For developers, secure coding practices, code reviews, dependency management, penetration testing, and regular security assessments can help identify problems before attackers find them.
Cybersecurity vulnerabilities come in many forms, and not every vulnerability works in the same way. Some, such as zero-days, describe the stage or status of a security flaw. Others, such as SQL injection and XSS, describe the technical weakness. Terms such as RCE and privilege escalation describe what an attacker may be able to accomplish.
Once you understand these differences, cybersecurity news becomes much easier to follow. When you see a headline about a “critical zero-day RCE vulnerability,” you can break it down into separate pieces instead of treating it as one complicated technical term.
