The attacks exploit a vulnerability or vulnerabilities in web applications that communicate with backend servers where the databases are stored.