Only XSS and SQLi