Sending malicious email payloads to target users

Exploiting image upload fields to fetch internal resources

Using input fields to bypass user authentication

Injecting SQL commands to extract database records