Exploiting user input validation on the server

Injecting malicious SQL queries

Direct modification of client-side transmitted parameters

Using brute-force techniques to guess session tokens