The application does not restrict input size, causing a buffer overflow.

Sensitive information is stored in plaintext in the database.

User accounts are not locked after multiple failed login attempts.

Client-side JavaScript checks the maximum value of an input field, but the server doesn’t enforce this.