Bypassing LFI (Local File Inclusion)

Open Redirection - QR Code Magic

Account Takeover - Smoking with 'null'