A stranger's program,on your server.
The most serious kind of flaw. A stranger gets your server to run their own program, and from then on they can do whatever your site can.
What it is
Your server runs the software your site is built from, and nothing else. This kind of flaw breaks that. Somewhere, the software treats something it was sent as instructions to follow, or keeps an uploaded file, such as a "photo", in a place where the server will run it.
What could happen to your site
Once a stranger's program runs on your server, they are in charge of the site. Common uses are adding pages that sell fake goods, sending spam from your address, copying your customer data, hiding a program that lets them back in later, or using your server to attack other sites.
Your site can look completely normal while this happens. Search engines and email providers often notice first, and mark your site or your email as unsafe.
How likely it is
These are rarer than other flaws, but they are the ones attackers want most. When one needs no login it is graded Dangerous, and automated tools start trying it on every site they can find within days of it becoming known. The US cyber security agency, CISA, keeps a list of flaws being used right now, and the Mendbird checks against it every morning.
How it gets fixed
Update to the fixed version straight away. If the flaw was known for a while before your site was updated, it is also worth checking nothing was left behind: new admin accounts, files that should not be there, or changed pages. Your host can often scan for this.
What to ask your developer
Send whoever looks after your site this:
Ask your developer“The Mendbird report says some of our software has a flaw that could let someone run code on the server. Can you update it this week, and check the site for anything that should not be there?”