graphql api vulnerabilities