Comments (vunerable to SQL Injection, XSS, CSRF)
Images (vunerable to exposure of files)
Evil site (for testing and with one XSS example)