Admin Game pass

I don’t know the name of any of the actual exploits, however:

This DevHub article also directly states that it’s possible for an exploiter to fake a remote event.

Remote functions and events are the best option for client-server communication, but they’re not necessarily secure channels. A clever hacker may fake a remote event or change the values that are passed along with it. Because of this, you should use basic server-side validation to confirm that the incoming request is legal.