What are the most common vulnerabilities that lead to API endpoints failing injection vulnerability tests during penetration assessments.