PayPal merchant directory reflected XSS
A duplicated q parameter in PayPal's merchant directory let an injected payload break out of script context, producing a reflected XSS that PayPal patched within days.
HTTP parameter pollution
Send the same parameter twice and see which copy the server believes.