To gain direct access to a database

To steal sensitive data or execute malicious scripts in a user's browser

To manipulate server-side configurations

To bypass authentication on the server