The Apache::AuthCAS module appears susceptible to SQL injection attacks via the cookie.
6c3e8b4698c146be668861a2872cbf0a4d87b2fd29b00d223d6693a8f5789115
The sarad program used at the British National Corpus is susceptible to multiple buffer overflows. No authentication is required to perform the attack and they are network based.
3b5dbe5c14fa19bf31747e7ab1ad0dfe738810272c2dbce61216a3114a9177e7