“Advanced web security topics” blog post goes over a variety of ways that a web application can get p0wned. Some of these include:
- Cross-site scripting (XSS)
- Mime-type attacks
- A variety of injections – SQL, JavaScript, HTTP
- URL indexing
- Click-jacking
- … and more.