[throwawaaarrgh]

It's somewhat disheartening as a security enthusiast that people only focus on "popular" security bugs and ignore the rest. The other top 21 bug classes aren't as "cool" but they will let me hack your app just the same.

[HideousKojima]

Sure, but SQL Injection will let a script kiddie steal and/or drop your entire poorly configured production DB.

[rainonmoon]

It also provides several paths to RCE depending on the environment, not just exfil.