broken auth
unvalidated redirect/forward
invalid input validation
sqli