CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-352 Cross-Site Request Forgery (CSRF)
CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')