Just like phishing attacks where hackers trick users into clicking malicious links in an email, a QR code can contain a malicous link. Once a user browses the link several things could occur:

• The website could contain scripts which attempt to determine if your browser has a vulnerability. If it does then the vulnerability could be automatically exploited. In the worst cased the exploit could allow an attacker to gain complete control of the device.
• The website could contain a fake login page, such as Office 365 login. If a user enters credentials the attacker gains access to the user's account and sensitive data.
• For mobile users the website could attempt to get user to install an app from the appstore intended to track users and gain access to thier sensitive data.