Large language models demonstrate high capability in exploiting open-source web application vulnerabilities, including logic flaws and expression injections