bret is a web applications ceh

What are some common vulnerabilities in web applications that he should be concerned about?