Surprising software vulnerabilities or exploits?

Everyone does know about SQL injections, but one of the most surprising exploits I recently heard about was putting SQL injections into bar codes. Testers should be checking ALL inputs for malicious SQL. An attacker could show up at an event and crash their registration system, change prices at stores, etc. I think just bar code hacking in general was surprising to me. No wow factor here, just something else to be aware of.

EDIT: Just had a discussion where the idea of putting the SQL injection on a magnetic card strip was brought up. I guess you can put one anywhere, so test any and all input, especially from users and these kinds of data storage devices.

Extremely simple method to mess with your web application: If the application allows users to add pictures to profiles, messages board or blog posts, malicious user can set up image URL like '/Account/LogOut' (or any other valid local URL causing actions we don't want). If he manage to publish his profile/post/message "up to main page" - every user will be logged out immediately after logging in (the browser will execute te request to /Account/LogOut in context of the current user in order to download the image), so the page functionality will by serously damaged.