Web2 vulnerabilities