Which of the following is a common Service Oriented Architecture (SOA) vulnerability?

Cross-site scripting is a client-side web application vulnerability that targets browsers and is not specific to the XML messaging layer of SOA.

SQL injection targets database query construction and is not specific to the XML-based service communication protocols used in SOA.

VPath injection is a path traversal variant that targets file system access and is not a recognized SOA-specific vulnerability category.

SOA environments rely heavily on XML-based communication protocols such as SOAP, making them susceptible to XML DoS attacks that involve sending maliciously crafted XML messages - such as deeply nested structures or exponentially expanding entities (e.g., Billion Laughs attack) - to overwhelm the XML parser. Because SOA exposes services through XML interfaces, this attack class is a well-documented and primary vulnerability specific to this architecture. Cross-site scripting and SQL injection target different layers and are not SOA-specific in the same way.