Spoiler: A few other answers which I think are right. Please correct me if I'm wrong or missing anything.
13. All of the above.
14. Just 5 I think?
16. 4 and 5
21. Looks like it wants a password of "hunt". The logic under it is either expecting the bitwise NOT'd value of a different static key or is doing something I don't understand.
22. Stack cookie. 2 and 3.
23. Definitely missing a lot of things, but #20 allows support users to execute anything as root due to the "*".
24. #15 - SQL injection, #21 - MD5 is unsuitable for password hashing, #25 - if an exception triggers you will automatically be authenticated, as "" == "", #28 - String comparison vulnerable to timing attacks
25. Lots of command injection. Buffer overflow in `error` function (buf holds 128 bytes but 128 + strlen("error: ") bytes could be copied to it). Probably many other things I'm missing.
26. No CSRF tokens (arguably not that necessary for these since every form wants some sort of password, but you could exploit vulns through someone else's browser via CSRF as a way of hiding the true source of the attack), SQL injection and XSS via $_GET['id'], SQLi with $_GET['email'], weak DB pass, LDAP injection with $_POST['username'], == should be ===, all user rows will be set to have the same recoveryPass due to missing WHERE clause in tue UPDATE, string comparison timing attacks, time() is a very weak and predictable seed for generating a random recovery password, you can probably hijack the emailer to send phishing messages and links by adding some extra text to $email with " someuseryouwanttophish+also visit http://evilsite.com@gmail.com" (I don't know if mail()/Gmail would actually deliver that due to the leading space and such, though). Probably missing 1 or 2 things.
Comments
Spoiler: A few other answers which I think are right. Please correct me if I'm wrong or missing anything.
13. All of the above.
14. Just 5 I think?
16. 4 and 5
21. Looks like it wants a password of "hunt". The logic under it is either expecting the bitwise NOT'd value of a different static key or is doing something I don't understand.
22. Stack cookie. 2 and 3.
23. Definitely missing a lot of things, but #20 allows support users to execute anything as root due to the "*".
24. #15 - SQL injection, #21 - MD5 is unsuitable for password hashing, #25 - if an exception triggers you will automatically be authenticated, as "" == "", #28 - String comparison vulnerable to timing attacks
25. Lots of command injection. Buffer overflow in `error` function (buf holds 128 bytes but 128 + strlen("error: ") bytes could be copied to it). Probably many other things I'm missing.
26. No CSRF tokens (arguably not that necessary for these since every form wants some sort of password, but you could exploit vulns through someone else's browser via CSRF as a way of hiding the true source of the attack), SQL injection and XSS via $_GET['id'], SQLi with $_GET['email'], weak DB pass, LDAP injection with $_POST['username'], == should be ===, all user rows will be set to have the same recoveryPass due to missing WHERE clause in tue UPDATE, string comparison timing attacks, time() is a very weak and predictable seed for generating a random recovery password, you can probably hijack the emailer to send phishing messages and links by adding some extra text to $email with " someuseryouwanttophish+also visit http://evilsite.com@gmail.com" (I don't know if mail()/Gmail would actually deliver that due to the leading space and such, though). Probably missing 1 or 2 things.