TIL you can use <form enctype="text/plain"> followed by <input name='{"foo": "' value='bar"}'> to construct and POST valid JSON to an undefended API endpoint from a regular HTML form, potentially bypassing same-origin defences and enabling a vector for CSRF attacks
browsers don't let you POST JSON cross-origin by default; the fun bit is that this gets encoded as {"foo":"=", "receiverid":"123", ...} in the submitted request. if the receiving endpoint doesn't validate content-type, it can parse it as JSON. (fixed now btw!)