Vulnerable login: query = 'SELECT * WHERE user='+input; input ' OR '1'='1 logs in as anyone: SQL injection. Fix: parameterized queries. Comment box rendering <script>steal()</script>: XSS; fix: escape HTML. Bank transfer via GET link: CSRF; fix: tokens. OWASP Top 10 catalogs these.