Cryptographic failures are usually not broken algorithms — they're misuse of crypto. Each tab picks a different misuse pattern from the A04 family.
Even with a slow hash, no salt means two users with the same password produce the SAME hash. Crack one → crack everyone who reused that password.
def store(user, pw):
db.insert(user, hashlib.sha256(pw.encode()).hexdigest()) # no salt!
Submit alice and bob both with password hunter2.
They're byte-for-byte identical. Crack one → both compromised.