Account Takeover - Smoking with 'null'

Open Redirect to XSS

Bypassing LFI (Local File Inclusion)